EUVD-2025-210281Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed AutoGPT instance
-
DeliveryAuthor agent with iterated screenshot block
-
ExploitSubmit large URL input list
-
ExecutionTrigger unbounded ScreenshotWebPageBlock loop
-
PersistFill temp directory disk space
-
ImpactHost disk exhausted, service unavailable
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must be able to reach the AutoGPT instance over the network and submit/execute an agent graph that contains both StepThroughItemsBlock and ScreenshotWebPageBlock (the two blocks named in the advisory) on a version prior to 0.6.63. CVSS 4.0 PR:N/UI:N/AT:N indicates no authentication, user interaction, or special attack requirement is needed in the vendor's modeling, so any deployment that exposes block-execution to anonymous users is exploitable; deployments that gate graph creation behind login, disable these specific blocks, or apply OS-level disk quotas to the AutoGPT working directory materially limit exploitability. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates network-reachable, low-complexity, fully unauthenticated exploitation with no user interaction - a strong real-world risk profile for any internet-exposed AutoGPT instance. Impact is narrowly scoped: VA:H (availability) only, with VC:N and VI:N, meaning the bug cannot leak data or alter integrity, only knock the host offline by filling disk. EPSS and KEV status are not provided in the input; no public exploit is identified and CISA has not listed it, so this is best treated as a credible self-service DoS against multi-tenant or exposed deployments rather than a targeted-attack priority. The main caveat is that PR:N assumes the AutoGPT UI/API is reachable without auth - in deployments that gate block execution behind login, real exposure is lower than the headline score suggests. |
| Exploit ScenarioDerived | An attacker with access to the AutoGPT graph builder constructs an agent that wires a large input list - for example thousands of URLs - into a StepThroughItemsBlock feeding a ScreenshotWebPageBlock, then triggers a run. The block iterates without bound and writes each screenshot to the temp directory until the underlying disk fills, at which point AutoGPT, co-located services, and potentially the host OS become unable to write and fail. No public proof-of-concept is identified at time of analysis, but the attack is trivial to assemble inside the product's normal UI. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 18, 2026
Denial of service in AutoGPT prior to 0.6.63 allows remote unauthenticated users to exhaust host disk space by chaining the StepThroughItemsBlock with the ScreenshotWebPageBlock to capture an unbounded number of screenshots into a temporary directory. No public exploit identified at time of analysis, but the attack requires no authentication and CVSS 4.0 rates availability impact as High (8.7).
RemediationAI
Upgrade to AutoGPT 0.6.63 or later, which patches both blocks per the vendor advisory at https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-7g34-7fvq-xxq6 (Vendor-released patch: 0.6.63). If immediate upgrade is not possible, restrict who can author or run agent graphs by placing AutoGPT behind authentication and removing untrusted users' ability to use the ScreenshotWebPageBlock or StepThroughItemsBlock (trade-off: breaks any legitimate workflow that relies on iterated screenshots), enforce filesystem quotas or a dedicated tmpfs with a hard size cap on AutoGPT's working/temp directory so disk exhaustion is contained to the agent runtime rather than the host (trade-off: legitimate long screenshot jobs will fail mid-run), and add monitoring/alerting on disk usage so the condition is detected before the host OS becomes unresponsive.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AutoGPT (Significant-Gravitas) is a workflow automation platform that composes AI agents from chainable 'Blocks'. The ScreenshotWebPageBlock writes captured page images to a temporary directory on the server's working filesystem, while the StepThroughItemsBlock provides iteration over a list of inputs. Neither block enforces a cap on iteration count nor on cumulative disk usage, which is a classic CWE-400 Uncontrolled Resource Consumption pattern: an attacker-controlled input set drives an O(n) resource allocation with no quota or rate-limit boundary.
Know when Autogpt gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable and low-complexity, but exploitation requires the ability to author and run an agent graph, which in realistic deployments implies at least a low-privilege account; only availability is impacted.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, ScreenshotWebPageBlock will store the captured screenshots in a temporary directory. StepThroughItemsBlock can be used to iterate ScreenshotWebPageBlock multiple times. StepThroughItemsBlock does not limit the number of loops. In addition, ScreenshotWebPageBlock does not limit the amount of disk space consumed in the current working directory. When a malicious user chooses to screen shot many web pages, the disk space will eventually run out, causing a DoS. Version 0.6.63 patches the issue.
Executive ViewAI
AutoGPT versions prior to 0.6.63 are vulnerable to remote denial-of-service attacks that exhaust disk space without authentication; no public exploit has been identified, but the attack is easily executable. Organizations running affected versions face significant operational risk of service unavailability. No vendor patch is currently available, requiring immediate implementation of compensating controls.
Restrict network access to AutoGPT to authorized users only; disable screenshot and web page capture blocks; implement and enforce disk space quotas on temporary storage directories; configure alerting for rapid disk consumption; implement API rate limiting to constrain attack surface.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
DOM-based cross-site scripting in AutoGPT versions prior to 0.6.62 allows remote attackers to execute arbitrary JavaScri
Resource exhaustion denial-of-service in Significant Gravitas AutoGPT versions prior to 0.6.63 allows remote unauthentic
Denial of service in Significant-Gravitas AutoGPT prior to 0.6.63 allows remote attackers to exhaust host disk space by
Denial of service in AutoGPT versions prior to 0.6.63 allows remote unauthenticated attackers to exhaust disk space on t
Server-side request forgery in the AutoGPT Platform (versions prior to 0.6.52) lets an authenticated user abuse the Send
Webhook signature verification bypass in AutoGPT Platform before 0.6.70 allows unauthenticated remote attackers to trigg
Insecure deserialization in Significant-Gravitas AutoGPT platform versions 0.6.34 through 0.6.51 lets an attacker who ca
Unauthenticated denial-of-service in AutoGPT Platform versions 0.4.2 through 0.6.51 allows remote attackers to exhaust s
Disk exhaustion denial-of-service in Significant Gravitas AutoGPT prior to version 0.6.63 allows authenticated platform
Authenticated session hijacking in Significant Gravitas AutoGPT versions 0.6.36 through 0.6.50 allows any logged-in user
Improper access control in AutoGPT’s webhook ping endpoint allows any authenticated user to enumerate other users’ webho
Memory exhaustion in AutoGPT's AITextSummarizerBlock allows authenticated users to trigger extreme resource amplificatio
Exploit-DB