Significant Gravitas AutoGPT Command Injection Vulnerability in Workflow Checker

A command injection vulnerability has been identified in the workflow-checker.yml file of Significant Gravitas AutoGPT, affecting all versions up to the latest release. The vulnerability arises from the insecure handling of untrusted user input, specifically the 'github.head.ref' variable, which can be exploited by injecting arbitrary commands. An attacker could create a branch name containing a malicious payload and submit a pull request, potentially gaining reverse shell access or stealing sensitive tokens and keys.

Impact

Exploitation of this vulnerability could lead to command injection, allowing an attacker to execute arbitrary commands on the server. This could result in reverse shell access or the theft of sensitive tokens and keys.