← Back

CVE-2024-9439

nvd nist
Published: Mar 20, 2025Modified: Jun 17, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: security@huntr.dev (Secondary)

Description

SuperAGI is vulnerable to remote code execution in the latest version. The `agent template update` API allows attackers to control certain parameters, which are then fed to the eval function without any sanitization or checks in place. This vulnerability can lead to full system compromise.

Affected (1)

Products: Superagi: Superagi
Superagi
1 product
Superagi
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Superagi
Version 0.0.14

Related CWEs

CWE-94
Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (1)

Source: security@huntr.dev
ExploitThird Party Advisory

Timeline

No history available yet.