AutoGPT EUVD-2025-210282

Attacker requires an authenticated AutoGPT account with permission to create and execute workflows on a target instance running a version prior to 0.6.63 (PR:L confirms low-privilege auth is required). Exploitation specifically depends on access to the AddAudioToVideoBlock, StepThroughItemsBlock, and MediaDurationBlock components and the ability to supply a list of URLs for screenshotting; no user interaction by another party is needed (UI:N). Limiting factors: single-tenant self-hosted instances effectively require the operator to attack themselves, and any environment that already enforces disk quotas on the AutoGPT working directory will see workflow failure rather than host-wide DoS.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L) and base score of 7.1 paint a coherent picture: network-reachable, low attack complexity, requires low-privilege authentication, and impact is limited to availability of the vulnerable system with a minor subsequent-system availability impact (likely the host filesystem affecting co-located services). There is no confidentiality or integrity exposure and no remote code execution path. EPSS, KEV, and SSVC data were not provided in the input, but the absence of a CISA KEV listing and no referenced public PoC suggest this is not under active exploitation. The realistic risk is moderate and primarily relevant to multi-tenant or publicly accessible AutoGPT deployments where an authenticated low-trust user could deny service to other tenants; single-user self-hosted instances face minimal risk since the attacker would be the operator.

An authenticated low-privilege user on a shared or public AutoGPT instance builds a workflow where StepThroughItemsBlock iterates over a large list of URLs, invoking MediaDurationBlock and AddAudioToVideoBlock on each item to screenshot pages and produce video output. Because the loop is unbounded and temporary media files are never cleaned up between iterations, the working directory fills until the host disk is exhausted, taking the AutoGPT service - and potentially other services on the same volume - offline. No public exploit code is referenced; exploitation requires only knowledge of which blocks to chain.