CVE-2025-1040 Server-Side Template Injection (SSTI) in significant-gravitas/autogpt

What is CVE-2025-1040?

CVE-2025-1040 is a high-severity code injection vulnerability in significant-gravitas/autogpt, published on 20 Mar 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

AutoGPT versions 0.3.4 and earlier are vulnerable to a Server-Side Template Injection (SSTI) that could lead to Remote Code Execution (RCE). The vulnerability arises from the improper handling of user-supplied format strings in the `AgentOutputBlock` implementation, where malicious input is passed to the Jinja2 templating engine without adequate security measures. Attackers can exploit this flaw to execute arbitrary commands on the host system. The issue is fixed in version 0.4.0.

Weakness: CWE-1336

Which versions are affected by CVE-2025-1040?

It affects 1 product.

Products include Agpt Autogpt Platform.

How do I fix CVE-2025-1040?

No fix has been published for CVE-2025-1040 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2025-1040 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-1040 exists.

Other vulnerabilities in significant-gravitas/autogpt

• CVE-2026-26020 AutoGPT Affected by Remote Code Execution via Dynamic Module Import in Block Loading (__import__) Critical 9.4
• CVE-2025-62615 AutoGPT has SSRF vulnerability in ReadRSSFeedBlock Critical 9.3
• CVE-2025-62616 AutoGPT has SSRF vulnerability in SendDiscordFileBlock Critical 9.3
• CVE-2025-32393 AutoGPT has a DoS vulnerability in ReadRSSFeedBlock High 8.7
• CVE-2026-24780 AutoGPT is Vulnerable to RCE via Disabled Block Execution High 8.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cjjc-mf84-xp9f.