The vulnerability involves an unsafe regular expression used in the code extraction block of the AutoGPT platform, which can trigger catastrophic backtracking when presented with a long string of whitespace characters. Because the regex patterns contain adjacent quantifiers that match the same whitespace, an attacker can craft input that causes the engine to spend excessive CPU time to evaluate the match, leading to a denial of service. The weakness corresponds to CWE‑1333, a denial‑of‑service risk due to inefficient regex.

The affected product is Significant‑Gravitas AutoGPT platform. All releases prior to 0.6.32 are vulnerable; the fix is included in 0.6.32 and later releases. The vulnerability exists in the code extraction block of the backend, which is part of the autogpt_platform repository.

The CVSS score of 6.5 indicates moderate severity; the EPSS score of less than 1 percent signals that the likelihood of exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to supply a specially crafted input containing a very long sequence of spaces to the code extraction block. Once triggered, the regex performs excessive backtracking, consuming CPU resources and resulting in a temporary denial of service. Because the affected component is accessed by any user able to provide input to the code extraction feature, the attack vector is likely remote but could also be local to a privileged user.