EUVD-2025-210283Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach AutoGPT workflow UI
-
DeliveryAuthor agent nesting MediaDurationBlock in StepThroughItemsBlock
-
ExploitSupply large URL list as iterator input
-
ExecutionTrigger repeated video downloads to working directory
-
PersistFill host disk with un-deleted temp files
-
ImpactAutoGPT and co-located services fail (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must be able to create or execute an AutoGPT workflow on the target instance (network-reachable AutoGPT instance with workflow authoring enabled, which is the default), and that workflow must use the MediaDurationBlock nested inside StepThroughItemsBlock with a sufficiently large input list. Exploitation is limited by whether the deployment exposes the workflow builder to untrusted users - instances behind authentication or restricted to a single trusted operator face minimal exposure - and by any underlying disk quotas or container size limits, which cap the achievable impact to that container rather than the host. Affected versions are strictly < 0.6.63. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VA:H only) accurately captures the profile: network-reachable, no authentication or user interaction, low complexity, and impact limited to availability - no confidentiality or integrity loss. The 8.7 base score is driven entirely by the ease of remotely starving a host of disk. EPSS and KEV data were not supplied; the vulnerability is not on CISA KEV and no public exploit is identified, so real-world risk is moderate rather than urgent - primarily a concern for multi-tenant or internet-exposed AutoGPT deployments where untrusted users can author or run workflows. For single-user local installs the practical risk is low. The PR:N rating assumes the AutoGPT instance permits arbitrary workflow creation by remote users, which is the default but may not match hardened deployments - verify before treating as fully unauthenticated. |
| Exploit ScenarioDerived | An attacker with access to the AutoGPT workflow editor builds an agent that wraps MediaDurationBlock inside StepThroughItemsBlock fed by a long list of URLs (e.g., many target web pages for screenshotting) and runs it once; each iteration downloads a video into the working directory and never deletes it, filling the host disk and causing AutoGPT and potentially co-located services to fail. No public exploit code is identified, but the attack requires only standard, documented block usage. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 18, 2026
Denial of service in Significant-Gravitas AutoGPT prior to 0.6.63 allows remote attackers to exhaust host disk space by chaining the unbounded StepThroughItemsBlock loop with MediaDurationBlock, which downloads videos to a temporary directory and never cleans them up. No public exploit identified at time of analysis, but the flaw is trivially triggerable through the normal agent-building UI in any AutoGPT instance reachable by an untrusted user.
RemediationAI
Vendor-released patch: upgrade to AutoGPT 0.6.63 or later, which fixes both the missing cleanup in MediaDurationBlock and the unbounded iteration in StepThroughItemsBlock; see https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-rg6v-m9x9-7wf9. If immediate upgrade is not possible, compensating controls include disabling or removing MediaDurationBlock and StepThroughItemsBlock from the available block registry (trade-off: any legitimate workflow using them will break), restricting workflow authoring to trusted/authenticated users via reverse-proxy authentication, running AutoGPT inside a container or VM with a strict tmpfs/disk quota on the working directory so resource exhaustion is contained, and monitoring disk usage with alerting to detect runaway workflows.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AutoGPT is an agent-orchestration platform whose workflows are composed of reusable 'blocks.' The MediaDurationBlock fetches remote media (e.g., screenshots, videos) into the working directory to read its duration but lacks any cleanup-on-exit or per-invocation size cap, while StepThroughItemsBlock provides an iterator with no upper bound on iteration count. Combined, they form a classic CWE-400 Uncontrolled Resource Consumption primitive: each loop iteration writes new media to disk and never frees it. The affected CPE is cpe:2.3:a:significant-gravitas:autogpt:*:*:*:*:*:*:*:* for all versions below 0.6.63.
Know when Autogpt gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Exploitation requires authoring/running a workflow on the AutoGPT instance, so PR:L rather than PR:N; impact is availability-only (disk exhaustion), so C:N/I:N/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, MediaDurationBlock will download and store the video in a temporary directory without deleting before all noded are done. StepThroughItemsBlock can be used to iterate MediaDurationBlock multiple times. StepThroughItemsBlock does not limit the number of loops. In addition, MediaDurationBlock does not limit the amount of disk space consumed in the current working directory and does not delete the video after outputing the result. When a malicious user chooses to screen shot many web pages, the disk space will eventually run out, causing a DoS. Version 0.6.63 patches the issue.
Executive ViewAI
Significant-Gravitas AutoGPT versions before 0.6.63 contain a denial-of-service vulnerability allowing remote disk space exhaustion through the agent-building interface, disrupting any exposed instance. Organizations running AutoGPT risk operational disruption if their instances are reachable by untrusted users. Immediate exposure assessment and access controls are required pending vendor patch availability.
No vendor-released patch identified at time of analysis. Implement strict network-level access controls to limit AutoGPT UI exposure to trusted internal networks only; deploy disk usage monitoring and alerting to detect abnormal activity; implement API rate limiting if available; prioritize patching in upgrade roadmap once available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
DOM-based cross-site scripting in AutoGPT versions prior to 0.6.62 allows remote attackers to execute arbitrary JavaScri
Resource exhaustion denial-of-service in Significant Gravitas AutoGPT versions prior to 0.6.63 allows remote unauthentic
Denial of service in AutoGPT prior to 0.6.63 allows remote unauthenticated users to exhaust host disk space by chaining
Denial of service in AutoGPT versions prior to 0.6.63 allows remote unauthenticated attackers to exhaust disk space on t
Server-side request forgery in the AutoGPT Platform (versions prior to 0.6.52) lets an authenticated user abuse the Send
Webhook signature verification bypass in AutoGPT Platform before 0.6.70 allows unauthenticated remote attackers to trigg
Insecure deserialization in Significant-Gravitas AutoGPT platform versions 0.6.34 through 0.6.51 lets an attacker who ca
Unauthenticated denial-of-service in AutoGPT Platform versions 0.4.2 through 0.6.51 allows remote attackers to exhaust s
Disk exhaustion denial-of-service in Significant Gravitas AutoGPT prior to version 0.6.63 allows authenticated platform
Authenticated session hijacking in Significant Gravitas AutoGPT versions 0.6.36 through 0.6.50 allows any logged-in user
Improper access control in AutoGPT’s webhook ping endpoint allows any authenticated user to enumerate other users’ webho
Memory exhaustion in AutoGPT's AITextSummarizerBlock allows authenticated users to trigger extreme resource amplificatio
Exploit-DB