CVE-2024-1881 is a critical (CVSS 9.8) OS command injection in AutoGPT, from v0.5.0 up to but not including 5.1.0. The shell command validation only checks the first word of a command, so restrictions can be bypassed. Upgrade to 5.1.0 or later and confirm in the project release notes.
What's affected
AutoGPT (significant-gravitas/autogpt), versions from v0.5.0 up to but not including 5.1.0. The fix is in 5.1.0.
The record says the flaw is in the function that validates shell commands against an allowlist or a denylist. It only checks the first word of the command. An attacker can therefore get commands executed that are not on the allowlist, or include harmful commands that the denylist does not catch, because the check never looks past that first word. The weakness is CWE-78, OS command injection.
The record references commit 26324f2 in the AutoGPT repository. The page I retrieved shows that commit as an update to the .env.template file, which changes default model names and does not show a security fix. So the commit alone does not confirm the fix. Read the project's release notes for the version the description names.
The CVSS vector in the record shows a network attack path with no privileges and no user interaction, and the highest impact ratings for confidentiality, integrity and availability. The score of 9.8 matches the description.
How to check if you're exposed
AutoGPT is a Python project, so check how you installed it. If you cloned the repository, look at the tag or commit:
git -C /path/to/AutoGPT describe --tags
git -C /path/to/AutoGPT log -1 --format=%H
If you installed it from a package or a container image, check the version tag the image or package reports. The record describes affected versions as v0.5.0 up to the fix, which it labels 5.1 or 5.1.0.
Also review how you run it. Check whether the server listens only on localhost, whether you launch it with the speech option, and whether your browser is on the same machine or network as the agent.
What to do now
- Find every AutoGPT instance in your environment, including prototypes and personal installs.
- Upgrade to 5.1.0 or later and confirm in the release notes.
- Do not rely on the shell command allowlist or denylist as a security boundary on older versions.
- Run agents in a container or VM with no access to production credentials, and with network egress limited.
- Keep the agent server off any network that untrusted users or sites can reach.
Why it matters
Allowlists and denylists for shell commands are fragile. Checking only the first word of a command ignores that shells can chain commands, substitute output and run several statements in one line. A check that sees only the opening word cannot judge what the whole string will do.
The better design is not to give an agent a general shell in the first place. If it needs to run a task, expose a narrow function with fixed arguments, and run it with limited rights. Treat any approval prompt or filter as one layer, never the only one.
The record's Known Exploited Vulnerabilities flag is false, and the sources I retrieved do not report exploitation. The related issues CVE-2024-1879 and CVE-2024-1880 affect the same project.
Quick check
Why is a first word check not enough?
Because a shell command line can contain several commands. Validating only the first word leaves the rest unchecked.
Which version fixes it?
The record says versions up to but not including 5.1.0 are affected, so 5.1.0 or later.
Sources
Last reviewed: 19 October 2026.
