Cyber Resilience

CVE-2024-6091

CriticalPublic PoCRCE

Published: 11 September 2024

Published
11 September 2024
Modified
05 August 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0018 38.8th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-6091 is a critical-severity OS Command Injection (CWE-78) vulnerability in Agpt Autogpt Classic. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Command Obfuscation (T1027.010); ranked at the 38.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the LLM/Generative AI Risks risk domain; MITRE ATLAS techniques in scope: LLM Prompt Injection (AML.T0051).

EU & UK References

Vulnerability details

A vulnerability in significant-gravitas/autogpt version 0.5.1 allows an attacker to bypass the shell commands denylist settings. The issue arises when the denylist is configured to block specific commands, such as 'whoami' and '/bin/whoami'. An attacker can circumvent this restriction by…

more

executing commands with a modified path, such as '/bin/./whoami', which is not recognized by the denylist.

CWE(s)
CWE-78

AI Security AnalysisAI

AI Category
AI Agent Protocols and Integrations
Risk Domain
LLM/Generative AI Risks
OWASP Top 10 for LLMs 2025
None mapped
Classification Reason
AutoGPT (significant-gravitas/autogpt) is an open-source autonomous AI agent framework that leverages LLMs like GPT to perform tasks, including executing shell commands. The vulnerability specifically impacts the agent's command execution security mechanism, fitting AI agent protocols and integrations.

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1027.010 Command Obfuscation Stealth
Adversaries may obfuscate content during command execution to impede detection.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
T1211 Exploitation for Stealth Stealth
Adversaries may exploit vulnerabilities to evade detection by hiding activity, suppressing logging, or operating within trusted or unmonitored components.
attack.mitre.org →
Why these techniques?

The vulnerability enables bypassing AutoGPT's shell command denylist via path obfuscation (e.g., '/bin/./whoami'), facilitating command obfuscation (T1027.010), Unix shell execution (T1059.004), and exploitation for defense evasion (T1211).

MITRE ATLAS TechniquesAI

MITRE ATLAS techniques

AML.T0051: LLM Prompt Injection

Affected Assets

agpt
autogpt classic
0.5.1

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

SI-10 Information Input Validation
addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References