EUVD-2026-37915Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L
Network-delivered link, low complexity, no attacker auth, requires victim click (UI:R); script runs in victim's authenticated origin so scope changes with high confidentiality and limited integrity/availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions prior to 0.6.62 have a DOM-based Cross-Site Scripting (XSS) vulnerability in AutoGPT's signup page. The application improperly trusts a URL parameter (next), which is passed to router.push. An attacker can craft a malicious link that, when opened by an authenticated user, performs a client-side redirect and executes arbitrary JavaScript in the context of their browser. This could lead to credential theft, internal network pivoting, and unauthorized actions performed on behalf of the victim. Version 0.6.62 patches the issue.
AnalysisAI
DOM-based cross-site scripting in AutoGPT versions prior to 0.6.62 allows remote attackers to execute arbitrary JavaScript in an authenticated victim's browser by tricking them into clicking a crafted signup-page link whose next URL parameter is passed unsanitized into router.push. No public exploit identified at time of analysis, but the GitHub Security Advisory (GHSA-j2cp-jg5q-38wj) confirms the issue and ships a fix in 0.6.62.
Technical ContextAI
AutoGPT is a Significant-Gravitas workflow automation platform for orchestrating long-running AI agents, with a Next.js/React front-end that uses the Next router's router.push for client-side navigation. The signup page reads a next query parameter and passes it directly into router.push without validating that the value is a same-origin path. CWE-87 (Improper Neutralization of Alternate XSS Syntax) covers this class: a javascript: or otherwise abusable URI placed in next becomes an executable navigation target, so the redirect primitive degrades into client-side script execution. The CPE cpe:2.3:a:significant-gravitas:autogpt:* confirms all AutoGPT releases before 0.6.62 share the vulnerable code path.
RemediationAI
Vendor-released patch: AutoGPT 0.6.62 - upgrade all front-end instances to 0.6.62 or later per the advisory at https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-j2cp-jg5q-38wj. If immediate upgrade is not possible, compensating controls include front-of-app filtering (web application firewall or reverse-proxy rule that strips or rejects next query parameters on /signup whose value is not a relative path beginning with / and not containing :), adding a strict Content-Security-Policy with script-src 'self' to block inline/javascript: execution (side effect: any legitimate inline scripts in AutoGPT may break and require testing), and operator awareness training to avoid clicking AutoGPT signup links received from untrusted sources until the patch is rolled out.
Denial of service in Significant-Gravitas AutoGPT prior to 0.6.63 allows remote attackers to exhaust host disk space by
Denial of service in AutoGPT prior to 0.6.63 allows remote unauthenticated users to exhaust host disk space by chaining
Denial of service in AutoGPT versions prior to 0.6.63 allows remote unauthenticated attackers to exhaust disk space on t
Resource exhaustion denial-of-service in Significant Gravitas AutoGPT versions prior to 0.6.63 allows remote unauthentic
Server-side request forgery in the AutoGPT Platform (versions prior to 0.6.52) lets an authenticated user abuse the Send
Webhook signature verification bypass in AutoGPT Platform before 0.6.70 allows unauthenticated remote attackers to trigg
Insecure deserialization in Significant-Gravitas AutoGPT platform versions 0.6.34 through 0.6.51 lets an attacker who ca
Unauthenticated denial-of-service in AutoGPT Platform versions 0.4.2 through 0.6.51 allows remote attackers to exhaust s
Authenticated session hijacking in Significant Gravitas AutoGPT versions 0.6.36 through 0.6.50 allows any logged-in user
Disk exhaustion denial-of-service in Significant Gravitas AutoGPT prior to version 0.6.63 allows authenticated platform
Improper access control in AutoGPT’s webhook ping endpoint allows any authenticated user to enumerate other users’ webho
Memory amplification denial-of-service in AutoGPT's ExtractTextInformationBlock enables authenticated users to exhaust s
Share
External POC / Exploit Code
Leaving vuln.today