What is the CVSS score of CVE-2026-33235?

CVE-2026-33235 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of AutoGPT are affected by CVE-2026-33235?

AutoGPT versions before 0.6.52 contain a denial-of-service vulnerability exploitable by authenticated users, with no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-33235?

Within 24 hours: Audit all AutoGPT installations to identify versions prior to 0.6.52. Within 7 days: Upgrade all instances to version 0.6.52 or later across all environments. Within 30 days: Verify patch deployment completion and establish monitoring for resource-exhaustion indicators.

AutoGPT CVE-2026-33235

EUVD-2026-39090 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-06-24 security-advisories@github.com

Python Denial Of Service

7.7

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

vuln.today AI

7.7 HIGH

Authenticated user can run the block (PR:L), network-reachable and low-complexity (AV:N/AC:L); resource exhaustion crosses tenant boundaries (S:C) with availability-only impact (A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Primary rating from Vendor (github).

CVSS VectorVendor: github

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 24, 2026 - 22:03 EUVD

Source Code Evidence Fetched

Jun 24, 2026 - 21:35 vuln.today

Analysis Generated

Jun 24, 2026 - 21:35 vuln.today

DescriptionCVE.org

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. In versions prior to 0.6.52, the Fill Text Template block is vulnerable to a Denial of Service (DoS) attack. While the backend implements a SandboxedEnvironment to prevent unauthorized attribute access (e.g., blocking __class__), it fails to limit the computational complexity or execution time of the expressions. An attacker can input computationally expensive Python/Jinja2 expressions that consume the server's CPU and memory, leading to a complete system hang or crash. In multi-tenant or self-hosted environments, this results in a complete service outage and "noisy neighbor" effects that require manual administrative intervention to recover. This issue has been fixed in version 0.6.52.

Articles & Coverage 1

News 3 New Python Vulnerabilities - 1 Critical, 2 High, 1 With POC Jun 25, 2026

AnalysisAI

Uncontrolled resource consumption in the AutoGPT platform (versions before 0.6.52) lets an authenticated user crash the server through the Fill Text Template block. The block's Jinja2 SandboxedEnvironment blocks dangerous attribute access but enforces no CPU, memory, or execution-time limits, so a crafted expression can exhaust server resources and hang or crash the host. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate to AutoGPT instance

Delivery

Create graph with Fill Text Template block

Exploit

Inject computationally expensive Jinja2 expression

Execution

Execute block to evaluate expression

Persist

Exhaust server CPU and memory

Impact

Host hangs or crashes (service outage)

Access

Authenticate to AutoGPT instance

Delivery

Create graph with Fill Text Template block

Exploit

Inject computationally expensive Jinja2 expression

Execution

Execute block to evaluate expression

Persist

Exhaust server CPU and memory

Impact

Host hangs or crashes (service outage)

Vulnerability AssessmentAI

Exploitation	Exploitation requires an authenticated low-privilege account (CVSS PR:L) that can create or run an agent graph using the Fill Text Template block - that block, which renders user-controlled Jinja2 through a SandboxedEnvironment with no execution-time or complexity limit, is the exact prerequisite. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H, score 7.7) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with high availability impact and a changed scope - consistent with a tenant being able to degrade the whole host. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An authenticated user on a shared or multi-tenant AutoGPT instance creates or edits an agent graph containing a Fill Text Template block and supplies a computationally expensive Jinja2 expression (for example one that forces enormous iteration or memory allocation). When the block executes, server CPU and memory are saturated, hanging or crashing the host and producing a service outage for all co-tenants until an administrator manually intervenes. …
Remediation	Upgrade to the vendor-released patch: AutoGPT platform version 0.6.52 (autogpt-platform-beta-v0.6.52), which fixes the issue per advisory GHSA-ppw9-h7rv-gwq9; download the release at https://github.com/Significant-Gravitas/AutoGPT/releases/tag/autogpt-platform-beta-v0.6.52. … Detailed patch versions, workarounds, and compensating controls in full report.