Home » Database

AVID-2026-R1408

Description

Vulnerability CVE-2024-21552

Details

All versions of SuperAGI are vulnerable to Arbitrary Code Execution due to unsafe use of the ‘eval’ function. An attacker could induce the LLM output to exploit this vulnerability and gain arbitrary code execution on the SuperAGI application server.

Reason for inclusion in AVID: CVE-2024-21552 describes arbitrary code execution in SuperAGI due to unsafe use of eval, enabling code execution on the application server. This is a vulnerability in AI-software (an AI agent framework) used in building and running general-purpose AI systems, affecting deployment/runtime components. It is a clear security vulnerability with evidence in the CVE entry and references.

References

Affected or Relevant Artifacts

  • Developer: n/a
  • Deployer: n/a
  • Artifact Details:
TypeName
SystemSuperAGI

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.1
Vector StringCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score9.8
Base Severity🔴 Critical
Attack VectorNETWORK
Attack Complexity🟢 Low
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality Impact🔴 High
Integrity Impact🔴 High
Availability Impact🔴 High

CWE

IDDescription
CWE-94Arbitrary Code Execution

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2024-07-22
  • Version: 0.3.3
  • AVID Entry