AutoGPT versions 0.6.34 through 0.6.51 deserialize Redis cache entries using pickle.loads without any integrity or authenticity verification, allowing an attacker who can poison a shared cache key to execute arbitrary code in the backend container. The vulnerability is classed as CWE-345, CWE-502, and CWE-94; it can compromise confidentiality, integrity, and availability and carries a CVSS score of 7.6.

The affected product is Significant‑Gravitas AutoGPT. Versions 0.6.34 to 0.6.51 are vulnerable; the issue was addressed in version 0.6.52 and later.

The EPSS score is not available, but the CVSS rating indicates a high risk. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an adversary who can write to a Redis cache key, either by direct access to the Redis instance or by exploiting an application path that writes to the cache without validation. No known publicly available exploits have been reported.