AutoGPT CVE-2026-33235

Exploitation requires an authenticated low-privilege account (CVSS PR:L) that can create or run an agent graph using the Fill Text Template block - that block, which renders user-controlled Jinja2 through a SandboxedEnvironment with no execution-time or complexity limit, is the exact prerequisite. No user interaction by a victim is needed (UI:N) and no special non-default configuration is required beyond having the block available. The principal limiting factor is authentication and the impact profile: the consequence is denial of service against availability only (no confidentiality or integrity impact), and meaningful harm to others requires a shared/multi-tenant or self-hosted-shared deployment, since a single-user install would only affect the attacker's own instance.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H, score 7.7) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with high availability impact and a changed scope - consistent with a tenant being able to degrade the whole host. PR:L confirms the attacker must be authenticated (a provisioned user able to create or run a graph containing the block), which meaningfully limits exposure compared to a pre-auth flaw. There is no EPSS score, KEV listing, or POC in the provided data, so likelihood signals are weak: this is a real availability priority for multi-tenant or shared self-hosted deployments (where one user can take down service for all), but a lower priority for single-user installations where the attacker would only be harming themselves. No data is internally conflicting; the main missing signals are EPSS probability and any independent confirmation of exploitation, neither of which is available here.

An authenticated user on a shared or multi-tenant AutoGPT instance creates or edits an agent graph containing a Fill Text Template block and supplies a computationally expensive Jinja2 expression (for example one that forces enormous iteration or memory allocation). When the block executes, server CPU and memory are saturated, hanging or crashing the host and producing a service outage for all co-tenants until an administrator manually intervenes. No public exploit code is identified at time of analysis, and the network vector with low attack complexity makes the attack trivial to perform once authenticated.