CVE-2025-51472

6.5 mediumEPSS 0.5%

Medium (6.5) in superagi superagi. EPSS 0.5% chance of exploitation in the next 30 days.

Code Injection in AgentTemplate.eval_agent_config in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to execute arbitrary Python code via malicious values in agent template configurations such as the goal, constraints, or instruction field, which are evaluated using eval() without validation during template loading or updates.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 40% of CVEs (scores of 2026-10-31)
CWE: CWE-77
Published: 2025-07-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

superagi:superagi

References

https://github.com/TransformerOptimus/SuperAGI
https://github.com/TransformerOptimus/SuperAGI/pull/1461
https://www.gecko.security/blog/cve-2025-51472

Check your stack JSON