VULNERABILITY INTELLIGENCE

CVE-2024-9439

CVSS score8.8 HIGH
EPSS probability1.22%
CISA KEVNot currently listed
Published2025-03-20
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

SuperAGI is vulnerable to remote code execution in the latest version. The `agent template update` API allows attackers to control certain parameters, which are then fed to the eval function without any sanitization or checks in place. This vulnerability can lead to full system compromise.

Weakness classification

  • CWE-94: Improper Control of Generation of Code ('Code Injection')

Primary references