CVE-2024-1880 is a high severity (CVSS 7.8) OS command injection in the macOS text to speech class of AutoGPT, in versions up to v0.5.0. It applies only when the speak option is on with the macOS provider. The description says it was addressed in 5.1.0, so upgrade or turn the option off.
What's affected
AutoGPT (significant-gravitas/autogpt), versions up to v0.5.0. The description says the issue was addressed in version 5.1.0.
The flaw is in the MacOSTTS class, in its _speech method. According to the description, the code uses os.system to run the macOS say command with text that comes from the agent, which allows arbitrary code execution if an attacker can inject shell commands into that text. The weakness is CWE-78, OS command injection.
The description limits the exposure: the issue is triggered only when AutoGPT runs with the --speak option and TEXT_TO_SPEECH_PROVIDER is set to macos. Linux and Windows deployments, and macOS runs without those settings, are outside the described path.
The record references commit 26324f2 in the AutoGPT repository. The page I retrieved shows that commit as an update to the .env.template file, which changes default model names and does not show a security fix. So the commit alone does not confirm the fix. Read the project's release notes for the version the description names.
The vector is local with low privileges, which is why the score is lower than the sibling issues in the same project.
How to check if you're exposed
AutoGPT is a Python project, so check how you installed it. If you cloned the repository, look at the tag or commit:
git -C /path/to/AutoGPT describe --tags
git -C /path/to/AutoGPT log -1 --format=%H
If you installed it from a package or a container image, check the version tag the image or package reports. The record describes affected versions as v0.5.0 up to the fix, which it labels 5.1 or 5.1.0.
Also review how you run it. Check whether the server listens only on localhost, whether you launch it with the speech option, and whether your browser is on the same machine or network as the agent.
For this CVE specifically, search your environment file for the two settings:
grep -n "TEXT_TO_SPEECH_PROVIDER" .env
ps aux | grep -i "speak"
If the provider is not set to macos or the speak option is never used, you are outside the trigger conditions the description gives.
What to do now
- Check whether anyone runs AutoGPT on macOS with --speak and the macos provider.
- Turn off the speak option or switch to a different provider until you have upgraded.
- Upgrade to 5.1.0 or later and confirm in the release notes.
- Treat anything an agent generates, including text from web pages it reads, as untrusted input for any shell call.
- Run agents with limited permissions, so a shell escape does not reach your credentials.
Why it matters
Passing text to a shell command through os.system is a long standing mistake. The shell reads the string as code, so special characters in the text can end one command and start another. The safe approach is to pass arguments as a list to a function that does not invoke a shell, or to avoid the shell entirely.
What makes this case notable is where the text comes from. An agent speaks what a language model produced, and that text can be shaped by web pages or documents the agent has read. Any pipeline that feeds model output into a shell needs the same care as one that feeds user input.
The record's Known Exploited Vulnerabilities flag is false.
Quick check
Does this affect Linux or Windows?
The description ties it to the macOS text to speech class, enabled with --speak and TEXT_TO_SPEECH_PROVIDER set to macos.
Which version fixes it?
The description says 5.1.0.
Sources
Last reviewed: 19 October 2026.
