CVE-2024-1879 is a high severity (CVSS 8.8) cross site request forgery flaw in AutoGPT v0.5.0, from significant-gravitas. A malicious web page can send crafted requests to a local AutoGPT server and run commands. The record says it was addressed in version 5.1, so upgrade and confirm in the release notes.
What's affected
AutoGPT (significant-gravitas/autogpt) version v0.5.0. The record lists the product as AutoGPT Classic, version 0.5.0, and says the issue was addressed in version 5.1.
Version label conflict. This record says 5.1, while the sibling record CVE-2024-1881 says versions from v0.5.0 up to but not including 5.1.0. The two labels almost certainly mean the same release, but the project's own numbering is unusual, so confirm the exact tag in the release notes.
The record references commit 26324f2 in the AutoGPT repository. The page I retrieved shows that commit as an update to the .env.template file, which changes default model names and does not show a security fix. So the commit alone does not confirm the fix. Read the project's release notes for the version the description names.
The weakness is CWE-352, cross site request forgery. The description says the API endpoint that receives instructions has no protection, so an attacker can send a user running AutoGPT on a local network to a malicious website. That site can then send crafted requests to the AutoGPT server, leading to command execution. It adds that CORS is enabled for arbitrary origins by default, so the attacker can also read the responses.
How to check if you're exposed
AutoGPT is a Python project, so check how you installed it. If you cloned the repository, look at the tag or commit:
git -C /path/to/AutoGPT describe --tags
git -C /path/to/AutoGPT log -1 --format=%H
If you installed it from a package or a container image, check the version tag the image or package reports. The record describes affected versions as v0.5.0 up to the fix, which it labels 5.1 or 5.1.0.
Also review how you run it. Check whether the server listens only on localhost, whether you launch it with the speech option, and whether your browser is on the same machine or network as the agent.
What to do now
- Find every machine where AutoGPT runs, including developer laptops and lab servers.
- Upgrade to the fixed release, 5.1 per the record, and confirm the version against the project release notes.
- Do not browse untrusted sites in a browser on the same machine or network as a running agent until it is updated.
- Restrict the agent server to localhost, and put authentication in front of it if it must be reachable.
- Run agents in a container or VM with limited permissions and no access to secrets you do not need.
Why it matters
Two default settings combine here. The endpoint that accepts instructions has no check on who sent the request, and the server allows cross origin requests from any site. A web page you open in your browser can then speak to the agent on your own machine, as if the page were you.
For an AI agent, the consequence is serious because the agent is built to run commands. Anything that can give it instructions can potentially make it act on your files and credentials. Local only services are not safe from the web: browsers will happily send requests to localhost for any page you visit.
The record's Known Exploited Vulnerabilities flag is false, and the sources I retrieved do not report exploitation. The CVSS vector requires user interaction, matching the need to visit the malicious page.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is a local only AutoGPT server safe from this?
No. The attack comes through the victim's browser, which can reach a local server.
Which version fixes it?
The record says 5.1. Its sibling record says 5.1.0. Confirm the tag in the project release notes.
Sources
Last reviewed: 19 October 2026.
