CVE-2025-51472 in SuperAGI
Summary
by MITRE • 07/22/2025
Code Injection in AgentTemplate.eval_agent_config in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to execute arbitrary Python code via malicious values in agent template configurations such as the goal, constraints, or instruction field, which are evaluated using eval() without validation during template loading or updates.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2025
The vulnerability identified as CVE-2025-51472 represents a critical code injection flaw within TransformerOptimus SuperAGI version 0.0.14. This security weakness resides in the AgentTemplate.eval_agent_config function which processes agent template configurations. The flaw arises from the improper use of the eval() function to execute user-supplied values from configuration fields including goal, constraints, and instruction parameters. This design pattern creates a direct pathway for remote attackers to inject and execute arbitrary Python code on the system hosting the SuperAGI platform. The vulnerability is particularly concerning because it occurs during template loading or updates, meaning that any malicious input provided through these fields can be immediately executed without proper validation or sanitization.
The technical implementation of this vulnerability stems from a fundamental security anti-pattern where dynamic code execution is performed without adequate input validation or sanitization measures. When attackers provide malicious payloads within the goal, constraints, or instruction fields of agent templates, the eval() function processes these inputs directly, treating them as executable Python code rather than mere text data. This behavior aligns with CWE-94, which describes "Improper Control of Generation of Code" and specifically addresses situations where eval() or similar functions are used with untrusted input. The flaw demonstrates a clear lack of proper input sanitization and code execution control mechanisms that should be implemented to prevent such dangerous code evaluation practices.
The operational impact of this vulnerability extends far beyond simple code execution, as it provides attackers with complete control over the affected system. Remote attackers can leverage this vulnerability to execute arbitrary commands, access sensitive data, modify system configurations, or even establish persistent backdoors within the SuperAGI environment. The implications are particularly severe given that SuperAGI platforms typically handle complex AI workflows and may process sensitive business or personal data through their agent configurations. This vulnerability could enable attackers to compromise entire AI automation pipelines, potentially affecting organizations that rely on these systems for critical business operations or data processing tasks. The attack surface is broad since any user with access to modify agent templates can potentially exploit this vulnerability, making it a significant risk for multi-user environments.
Mitigation strategies for this vulnerability must address both immediate remediation and long-term architectural improvements. The most critical immediate action involves replacing the eval() function calls with safe alternatives such as ast.literal_eval() for simple data structures or implementing proper input validation and sanitization mechanisms before any code execution occurs. Organizations should also implement strict access controls and audit logging for template modification activities to detect potential exploitation attempts. The fix should align with security best practices outlined in the MITRE ATT&CK framework, particularly focusing on techniques related to command and script injection, where adversaries attempt to execute malicious code through legitimate system interfaces. Additionally, implementing proper input validation at multiple layers including application-level sanitization, parameterized queries, and runtime code analysis can significantly reduce the risk of exploitation. Regular security assessments and code reviews should be conducted to identify similar patterns and prevent future occurrences of such vulnerabilities in the codebase.