CVE-2024-9439

Description

SuperAGI is vulnerable to remote code execution in the latest version. The `agent template update` API allows attackers to control certain parameters, which are then fed to the eval function without any sanitization or checks in place. This vulnerability can lead to full system compromise.

Reserved 2024-10-02 | Published 2025-03-20 | Updated 2025-03-20 | Assigner @huntr_ai

Problem types

CWE-94 Improper Control of Generation of Code

Product status

Any version
affected

References

huntr.com/bounties/d710884f-b5ab-4b31-a2e6-e4b38488def1

cve.org (CVE-2024-9439)

nvd.nist.gov (CVE-2024-9439)

Download JSON