PatchTheCVECVE-2024-1880: An OS command injection vulnerability exists in the MacOS Text-To-Speech class MacOSTTS of the significant-gra
CVE-2024-1880 is a high-severity flaw (CVSS 7.8) affecting autogpt classic. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An OS command injection vulnerability exists in the MacOS Text-To-Speech class MacOSTTS of the significant-gravitas/autogpt project, affecting versions up to v0.5.0. The vulnerability arises from the improper neutralization of special elements used in an OS command within the `_speech` method of the MacOSTTS class. Specifically, the use of `os.system` to execute the `say` command with user-supplied text allows for arbitrary code execution if an a
Why this priority
- High severity
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.8 (High) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 1.0% (top 37%) |
| CISA exploited list | No |
| Weakness | CWE-78 |
| Published | 2024-06-06 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-1880?
autogpt classic: upgrade to 0.5.1. Exact commands for each OS are on this page.
Is CVE-2024-1880 being exploited?
CVE-2024-1880 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-1880 affect?
CVE-2024-1880 affects autogpt classic. Severity is high (CVSS 7.8). An OS command injection vulnerability exists in the MacOS Text-To-Speech class MacOSTTS of the significant-gravitas/autogpt project, affecting versions up to v0.5.0. The vulnerability arises from the improper neutralization of special eleme
How urgent is CVE-2024-1880?
Priority 48/100. High severity; Public exploit reference
Software pages
Related CVEs
- CVE-2024-8156 CRITICAL 9.8 UPGRADE A command injection vulnerability exists in the workflow-checker.yml workflow of significant-gravitas/autogpt
- CVE-2024-6091 CRITICAL 9.8 DOWNGRADE A vulnerability in significant-gravitas/autogpt version 0.5.1 allows an attacker to bypass the shell commands
- CVE-2024-1881 CRITICAL 9.8 UPGRADE AutoGPT, a component of significant-gravitas/autogpt, is vulnerable to an improper neutralization of special e
- CVE-2024-1879 HIGH 8.8 DOWNGRADE A Cross-Site Request Forgery (CSRF) vulnerability in significant-gravitas/autogpt version v0.5.0 allows attack