{"id":"CVE-2024-9439","aliases":["EUVD-2025-6842","GHSA-mq78-p977-pwgv"],"status":"published","title":"Remote Code Execution in transformeroptimus/superagi","description":"SuperAGI is vulnerable to remote code execution in the latest version. The `agent template update` API allows attackers to control certain parameters, which are then fed to the eval function without any sanitization or checks in place. This vulnerability can lead to full system compromise.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01224,"percentile":0.69028,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-94"],"published":"2025-03-20T10:10:34Z","modified":"2026-10-28T02:31:09Z","products":[{"vendor":"superagi","product":"superagi"},{"vendor":"transformeroptimus","product":"transformeroptimus/superagi"}],"references":[{"url":"https://huntr.com/bounties/d710884f-b5ab-4b31-a2e6-e4b38488def1","tags":["Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9439","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mq78-p977-pwgv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/9xxx/CVE-2024-9439.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-9439","title":"Remote Code Execution in transformeroptimus/superagi","description":"SuperAGI is vulnerable to remote code execution in the latest version. The `agent template update` API allows attackers to control certain parameters, which are then fed to the eval function without any sanitization or checks in place. This vulnerability can lead to full system compromise.","status":"published","published":"2025-03-20T10:10:34.836Z","modified":"2025-03-20T18:19:47.04Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:05.823187Z"}],"euvd":[{"id":"EUVD-2025-6842","description":"SuperAGI is vulnerable to remote code execution in the latest version. The `agent template update` API allows attackers to control certain parameters, which are then fed to the eval function without any sanitization or checks in place. This vulnerability can lead to full system compromise.","status":"published","published":"2025-03-20T10:10:34Z","modified":"2025-03-20T18:19:47Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:57.377828Z"}],"ghsa":[{"id":"GHSA-mq78-p977-pwgv","title":"SuperAGI is vulnerable to remote code execution in the latest version. The `agent template update...","description":"SuperAGI is vulnerable to remote code execution in the latest version. The `agent template update` API allows attackers to control certain parameters, which are then fed to the eval function without any sanitization or checks in place. This vulnerability can lead to full system compromise.","status":"published","published":"2025-03-20T12:32:51Z","modified":"2025-03-20T12:33:00Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:00:23.060957Z"}],"nvd":[{"id":"CVE-2024-9439","description":"SuperAGI is vulnerable to remote code execution in the latest version. The `agent template update` API allows attackers to control certain parameters, which are then fed to the eval function without any sanitization or checks in place. This vulnerability can lead to full system compromise.","status":"published","published":"2025-03-20T10:15:49.077Z","modified":"2026-06-17T08:24:34.4Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:10:45.815983Z"}],"osv":[{"id":"CVE-2024-9439","title":"Remote Code Execution in transformeroptimus/superagi","description":"SuperAGI is vulnerable to remote code execution in the latest version. The `agent template update` API allows attackers to control certain parameters, which are then fed to the eval function without any sanitization or checks in place. This vulnerability can lead to full system compromise.","status":"published","published":"2025-03-20T10:10:34.836Z","modified":"2026-10-28T02:31:09.476327453Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:44:45.712478Z"}]}}