The vulnerability arises because the AutoGPT Platform’s block execution endpoints allow an authenticated user to execute a BlockInstallationBlock marked as disabled. The endpoint writes arbitrary Python code to the server filesystem and imports it with __import__(), giving the user full remote code execution over the host. This reflects weaknesses in permission checks (CWE‑276), incorrect function handling (CWE‑863), and code generation control (CWE‑94). The attacker can run any code with the process’s privileges, potentially taking over the system.

All AutoGPT Platform instances running a version earlier than autogpt-platform-beta‑v0.6.44 are affected. The product is the AutoGPT Platform developed by Significant‑Gravitas. No additional version specifics are provided.

The CVSS score is 8.6, indicating high severity, while the EPSS score is below 1%, suggesting a very low probability of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. The attack requires authentication; an adversary can self‑register in a default self‑hosted installation with signup enabled, or otherwise must obtain a valid user account. Once authenticated, the attacker can trigger the disabled block via the exposed API and achieve remote code execution, which grants full control over the server.