AutoGPT CVE-2025-32422

Attacker must be able to submit or execute an AutoGPT workflow graph (in default deployments this is the platform's primary, network-exposed capability, hence PR:N in CVSS) and the graph must include StepThroughItemsBlock chained into FileStoreBlock with an attacker-influenced list of downloadable URLs. Limiting factors: the target must be running AutoGPT prior to 0.6.63, the working directory must be on a filesystem without an external quota, and impact severity depends on how much free disk the host has and whether other services share that filesystem. There is no required user interaction and no authentication is mandated by the CVSS vector, though real-world deployments may front the API with their own auth layer.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) is internally consistent: remote, low-complexity, no privileges, no user interaction, and impact restricted to availability of the vulnerable system - which matches the description of a disk-exhaustion DoS with no confidentiality or integrity loss. The 8.7 score reflects how easy the abuse is rather than catastrophic impact; in practice severity scales with the deployment model - a multi-tenant or internet-exposed AutoGPT instance accepting attacker-controlled workflows is at meaningful risk, while a single-user local instance is largely self-DoS. No EPSS score, KEV listing, or POC was provided in the intelligence inputs, so this is not (yet) confirmed actively exploited - no public exploit identified at time of analysis. Net: a real but bounded availability issue, prioritize for hosted/shared deployments, lower urgency for isolated single-user setups.

An attacker with access to submit or trigger an AutoGPT workflow constructs a graph in which StepThroughItemsBlock is fed a large list referencing a moderately sized downloadable file (for example a ~100MB URL the attacker controls), and pipes each item into FileStoreBlock. Because there is no iteration cap and no cumulative disk quota, the loop runs until the host's working-directory filesystem fills, taking AutoGPT and potentially co-located services offline. No public exploit identified at time of analysis, but the description itself is a step-by-step recipe.