https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-8156.htmlhttps://patchthecve.com/cve/CVE-2024-8156.htmlWed, 17 Jun 2026 08:22:00 +0000CRITICAL 9.8: A command injection vulnerability exists in the workflow-checker.yml workflow of significant-gravitas/autogpt. The untrusted user input `github.head.ref` is used insecurely, allowing an attacker to inject arbitrary commands. This vulnerability affects versions up to and including the latest version.https://patchthecve.com/cve/CVE-2024-6091.htmlhttps://patchthecve.com/cve/CVE-2024-6091.htmlWed, 17 Jun 2026 08:17:16 +0000CRITICAL 9.8: A vulnerability in significant-gravitas/autogpt version 0.5.1 allows an attacker to bypass the shell commands denylist settings. The issue arises when the denylist is configured to block specific commands, such as 'whoami' and '/bin/whoami'. An attacker can circumvent this restriction by executing chttps://patchthecve.com/cve/CVE-2024-1881.htmlhttps://patchthecve.com/cve/CVE-2024-1881.htmlWed, 17 Jun 2026 07:05:12 +0000CRITICAL 9.8: AutoGPT, a component of significant-gravitas/autogpt, is vulnerable to an improper neutralization of special elements used in an OS command ('OS Command Injection') due to a flaw in its shell command validation function. Specifically, the vulnerability exists in versions v0.5.0 up to but not includihttps://patchthecve.com/cve/CVE-2024-1880.htmlhttps://patchthecve.com/cve/CVE-2024-1880.htmlWed, 17 Jun 2026 07:05:12 +0000HIGH 7.8: An OS command injection vulnerability exists in the MacOS Text-To-Speech class MacOSTTS of the significant-gravitas/autogpt project, affecting versions up to v0.5.0. The vulnerability arises from the improper neutralization of special elements used in an OS command within the `_speech` method of thehttps://patchthecve.com/cve/CVE-2024-1879.htmlhttps://patchthecve.com/cve/CVE-2024-1879.htmlWed, 17 Jun 2026 07:05:12 +0000HIGH 8.8: A Cross-Site Request Forgery (CSRF) vulnerability in significant-gravitas/autogpt version v0.5.0 allows attackers to execute arbitrary commands on the AutoGPT server. The vulnerability stems from the lack of protections on the API endpoint receiving instructions, enabling an attacker to direct a use