Home » Database

AVID-2026-R1636

Description

Remote Code Execution in transformeroptimus/superagi (CVE-2024-9439)

Details

SuperAGI is vulnerable to remote code execution in the latest version. The agent template update API allows attackers to control certain parameters, which are then fed to the eval function without any sanitization or checks in place. This vulnerability can lead to full system compromise.

Reason for inclusion in AVID: CVE-2024-9439 describes a remote code execution vulnerability in the AI framework/agent platform (transformeroptimus/superagi). The attack leverages an API (agent template update) to feed unsanitized input into an eval, enabling full system compromise. This directly concerns AI software stacks and their deployment/runtime components, i.e., GPAI-related supply chain elements (AI frameworks/tools and their dependencies). The report provides explicit vulnerability behavior (RCE), affected artifact, and CVE details, satisfying sufficient evidence for AVID curation.

References

Affected or Relevant Artifacts

  • Developer: transformeroptimus
  • Deployer: transformeroptimus
  • Artifact Details:
TypeName
Systemtransformeroptimus/superagi

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.0
Vector StringCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score8.8
Base Severity🔴 High
Attack VectorNETWORK
Attack Complexity🟢 Low
Privileges Required🟢 Low
User InteractionNONE
ScopeUNCHANGED
Confidentiality Impact🔴 High
Integrity Impact🔴 High
Availability Impact🔴 High

CWE

IDDescription
CWE-94CWE-94 Improper Control of Generation of Code

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2025-03-20
  • Version: 0.3.3
  • AVID Entry