Server-Side Request Forgery Vulnerability in Significant Gravitas AutoGPT

CVE-2025-0454

What is CVE-2025-0454?

A Server-Side Request Forgery (SSRF) vulnerability has been detected within the Requests utility of Significant Gravitas AutoGPT versions before v0.4.0. This flaw is triggered by hostname confusion caused by the urlparse function from Python's urllib.parse library interacting incorrectly with the requests library. An attacker can exploit this weakness by sending a specially crafted URL, such as http://localhost:@google.com/../, which circumvents standard SSRF protections, potentially leading to unauthorized access or data exposure.

References