What is the CVSS score of CVE-2026-33235?

CVE-2026-33235 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of AutoGPT are affected by CVE-2026-33235?

AutoGPT versions before 0.6.52 contain a denial-of-service vulnerability exploitable by authenticated users, with no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-33235?

Within 24 hours: Audit all AutoGPT installations to identify versions prior to 0.6.52. Within 7 days: Upgrade all instances to version 0.6.52 or later across all environments. Within 30 days: Verify patch deployment completion and establish monitoring for resource-exhaustion indicators.

AutoGPT CVE-2026-33235

EUVD-2026-39090 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-06-24 security-advisories@github.com

Denial Of Service Python

7.7

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

vuln.today AI

7.7 HIGH

Authenticated user can run the block (PR:L), network-reachable and low-complexity (AV:N/AC:L); resource exhaustion crosses tenant boundaries (S:C) with availability-only impact (A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 24, 2026 - 22:03 EUVD

Source Code Evidence Fetched

Jun 24, 2026 - 21:35 vuln.today

Analysis Generated

Jun 24, 2026 - 21:35 vuln.today

DescriptionCVE.org

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. In versions prior to 0.6.52, the Fill Text Template block is vulnerable to a Denial of Service (DoS) attack. While the backend implements a SandboxedEnvironment to prevent unauthorized attribute access (e.g., blocking __class__), it fails to limit the computational complexity or execution time of the expressions. An attacker can input computationally expensive Python/Jinja2 expressions that consume the server's CPU and memory, leading to a complete system hang or crash. In multi-tenant or self-hosted environments, this results in a complete service outage and "noisy neighbor" effects that require manual administrative intervention to recover. This issue has been fixed in version 0.6.52.

Articles & Coverage 1

News 3 New Python Vulnerabilities - 1 Critical, 2 High, 1 With POC Jun 25, 2026

AnalysisAI

Uncontrolled resource consumption in the AutoGPT platform (versions before 0.6.52) lets an authenticated user crash the server through the Fill Text Template block. The block's Jinja2 SandboxedEnvironment blocks dangerous attribute access but enforces no CPU, memory, or execution-time limits, so a crafted expression can exhaust server resources and hang or crash the host. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the bug is straightforward to trigger and the vendor has shipped a fix in 0.6.52.

Technical ContextAI

AutoGPT is a workflow-automation platform for building and running continuous AI agents. The vulnerable component is the Fill Text Template block, which renders user-supplied text through Jinja2. The backend uses Jinja2's SandboxedEnvironment, which is designed to prevent template injection by restricting access to unsafe Python internals (for example blocking dunder attributes like __class__). However, the sandbox only constrains *what* expressions can reach - it does not constrain *how much work* they perform. This maps to CWE-400 (Uncontrolled Resource Consumption): the root cause is the absence of computational-complexity, recursion, or wall-clock limits on template evaluation, so an attacker can submit syntactically valid but computationally explosive expressions (e.g., large range/multiplication or deeply nested loops) that the sandbox happily executes to completion.

RemediationAI

Upgrade to the vendor-released patch: AutoGPT platform version 0.6.52 (autogpt-platform-beta-v0.6.52), which fixes the issue per advisory GHSA-ppw9-h7rv-gwq9; download the release at https://github.com/Significant-Gravitas/AutoGPT/releases/tag/autogpt-platform-beta-v0.6.52. If immediate upgrade is not possible, compensating controls for shared deployments include restricting or disabling the Fill Text Template block for untrusted users (trade-off: breaks legitimate templating workflows), running each tenant's agent execution under per-process CPU/memory and timeout limits via cgroups or container resource limits so a runaway template cannot starve the host (trade-off: legitimate heavy jobs may be killed), and limiting account provisioning to trusted users to reduce the attacker population (trade-off: slows onboarding). These mitigations reduce blast radius but do not remove the underlying lack of execution limits, so patching to 0.6.52 remains the durable fix.