GitHub Security Advisory: GHSA-r277-3xc5-c79v
Package: agpt (PIP)
Severity: HIGH (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection'), CWE-276: Incorrect Default Permissions, CWE-863: Incorrect Authorization
Vulnerable versions: <= 0.2.2
Patched in: unpatched

Summary: AutoGPT is Vulnerable to RCE via Disabled Block Execution

Details:
### Summary

AutoGPT Platform's block execution endpoints (both main web API and external API) allow executing blocks by UUID without checking the `disabled` flag. Any authenticated user can execute the disabled `BlockInstallationBlock`, which writes arbitrary Python code to the server filesystem and executes it via `__import__()`, achieving Remote Code Execution. In default self-hosted deployments where Supabase signup is enabled, an attacker can self-register; if signup is disabled (e.g., hosted), the attacker needs an existing account.

### Details

**Two vulnerable endpoints exist:**

1. **Main Web API** ([`v1.py#L355-395`](https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/api/features/v1.py#L355-L395)) - Any authenticated user:

```python
@v1_router.post(
    path="/blocks/{block_id}/execute",
    dependencies=[Security(requires_user)],  # Just requires login
)
async def execute_graph_block(block_id: str, data: BlockInput, ...):
    obj = get_block(block_id)
    if not obj:
        raise HTTPException(status_code=404, ...)

    # NO CHECK FOR obj.disabled!

    async for name, data in obj.execute(data, ...):
        output[name].append(data)
```

2. **External API** ([`external/v1/routes.py#L79-93`](https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/api/external/v1/routes.py#L79-L93)) - Same issue.

The external API is gated by API key permissions, but any authenticated user can mint API keys with arbitrary permissions via the main API (including `EXECUTE_BLOCK`) at [`v1.py#L1408-1424`](https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/api/features/v1.py#L1408-L1424). As a result, a low-privilege user can create an API key and invoke the external block execution route.

**The disabled flag is documented but not enforced:**

From [`block.py#L459`](https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/data/block.py#L459):
> "disabled: If the block is disabled, it will not be available for execution."

The block listing endpoint correctly filters disabled blocks (`if not b.disabled`), but the execution endpoints do not check this flag.

**The dangerous block ([`blocks/block.py#L15-78`](https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/blocks/block.py#L15-L78)):**

```python
class BlockInstallationBlock(Block):
    """
    NOTE: This block allows remote code execution on the server,
    and it should be used for development purposes only.
    """

    def __init__(self):
        super().__init__(
            id="45e78db5-03e9-447f-9395-308d712f5f08",  # Hardcoded, public UUID
            disabled=True,  # NOT ENFORCED!
        )

    async def run(self, input_data: Input, **kwargs) -> BlockOutput:
        code = input_data.code

        # Writes attacker code to server filesystem
        file_path = f"{block_dir}/{file_name}.py"
        wi