AutoGPT EUVD-2025-210279

The attacker must be able to submit and execute a workflow that includes the LoopVideoBlock on the target AutoGPT instance (version below 0.6.63) and supply both an input video file and an attacker-chosen loop count. The CVSS vector lists PR:N/UI:N, so no authentication or victim interaction is asserted at the CVSS level, but in practice exploitation is limited to environments where the AutoGPT block-execution interface is reachable by the attacker - typically multi-user or internet-exposed deployments. Limiting factors: the host must have enough free disk for the write to noticeably impact service, and instances that gate workflow creation behind authentication effectively constrain who can trigger the flaw.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VA:H accurately describes a network-reachable, unauthenticated, low-complexity availability attack with no confidentiality or integrity impact - a true single-axis DoS. There is no EPSS score, no KEV listing, and no public PoC referenced, so real-world exploitation pressure appears low despite the high base score. The realistic risk is concentrated on multi-tenant or internet-exposed AutoGPT deployments where one user's workflow can starve the shared host; isolated single-user installs face mostly self-DoS. Note the description implies the attacker must be able to submit a workflow using LoopVideoBlock, which in practice means having access to the AutoGPT UI/API - a deployment-specific authorization assumption the CVSS PR:N does not capture.

An attacker with access to an AutoGPT instance creates an agent or workflow that invokes LoopVideoBlock with a small input video and an extremely large loop count, then triggers execution. AutoGPT concatenates the video the requested number of times and writes the resulting multi-gigabyte file to disk, exhausting storage and crashing the host or co-located services. No public exploit identified at time of analysis, but the attack is trivial to script once the LoopVideoBlock is reachable.