Vulnerabilities

TI-2026-15580 CVE-2026-19060 · GHSA-r9xf-wghf-rmpc

FoundationAgents MetaGPT code injection

MEDIUM 55

A vulnerability was identified in FoundationAgents MetaGPT up to 0.8.2.

CVSS 4.0MEDIUM 4.8 Local Low privileges No interaction EPSS 0.00196 Published 2026-08-06 No fix listed CWE-74

TI-2026-15579 CVE-2026-19059 · GHSA-x7c6-rrf2-hrj9

FoundationAgents MetaGPT editor.py read path traversal

MEDIUM 55

A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2.

CVSS 4.0MEDIUM 4.8 Local Low privileges No interaction EPSS 0.00212 Published 2026-08-06 No fix listed CWE-22

TI-2026-15578 CVE-2026-19058 · GHSA-5j3c-8q7x-589c

FoundationAgents MetaGPT data_interpreter.py DataInterpreter code injection

MEDIUM 55

A vulnerability was found in FoundationAgents MetaGPT up to 0.8.2.

CVSS 4.0MEDIUM 4.8 Local Low privileges No interaction EPSS 0.00195 Published 2026-08-06 No fix listed CWE-74

TI-2026-09884 CVE-2026-11455 · GHSA-h4jg-8v58-57wj

FoundationAgents MetaGPT common.py check_cmd_exists command injection

MEDIUM 45

A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.01029 Published 2026-06-07 No fix listed CWE-74

TI-2026-09088 CVE-2026-10566 · GHSA-3c3g-7hwg-9qmr

FoundationAgents MetaGPT schema.py Message.check_instruct_content deserialization

MEDIUM 55

A weakness has been identified in FoundationAgents MetaGPT up to 0.8.2.

CVSS 4.0MEDIUM 4.8 Local Low privileges No interaction EPSS 0.00122 Published 2026-06-02 No fix listed CWE-20

TI-2026-05355 CVE-2026-6111 · GHSA-r5v8-c28h-f8r8

FoundationAgents MetaGPT common.py decode_image server-side request forgery

MEDIUM 57

A security flaw has been discovered in FoundationAgents MetaGPT up to 0.8.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00263 Published 2026-04-12 No fix listed CWE-918

TI-2026-05354 CVE-2026-6110 · GHSA-xr7v-m9px-q4qj

FoundationAgents MetaGPT Tree-of-Thought Solver tot.py generate_thoughts code injection

HIGH 70

A vulnerability was identified in FoundationAgents MetaGPT up to 0.8.1.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00409 Published 2026-04-12 No fix listed CWE-74

TI-2026-05353 CVE-2026-6109 · GHSA-w287-wwhf-95vv

FoundationAgents MetaGPT Mineflayer HTTP API index.js evaluateCode cross-site request forgery

MEDIUM 57

A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.1.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00224 Published 2026-04-12 No fix listed CWE-352

TI-2026-05237 CVE-2026-5974 · GHSA-fcc8-4q7h-wvwc

FoundationAgents MetaGPT terminal.py Bash.run os command injection

HIGH 70

A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.1.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.02559 Published 2026-04-09 No fix listed CWE-77

TI-2026-05236 CVE-2026-5973 · GHSA-qw5f-qpq5-ppfg

FoundationAgents MetaGPT common.py get_mime_type os command injection

HIGH 70

A vulnerability was found in FoundationAgents MetaGPT up to 0.8.1.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.02608 Published 2026-04-09 No fix listed CWE-77

TI-2026-05235 CVE-2026-5972 · GHSA-wp29-qmvj-frvp

FoundationAgents MetaGPT terminal.py Terminal.run_command os command injection

HIGH 70

A vulnerability has been found in FoundationAgents MetaGPT up to 0.8.1.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.02659 Published 2026-04-09 Fixed in 0.8.2 CWE-77

TI-2026-05234 CVE-2026-5971 · GHSA-3ghp-8r47-4gj4

FoundationAgents MetaGPT XML action_node.py ActionNode.xml_fill eval injection

HIGH 70

A flaw has been found in FoundationAgents MetaGPT up to 0.8.1.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00403 Published 2026-04-09 No fix listed CWE-94

TI-2026-05233 CVE-2026-5970 · GHSA-g977-h85w-h2xj

FoundationAgents MetaGPT HumanEvalBenchmark/MBPPBenchmark check_solution code injection

HIGH 70

A vulnerability was detected in FoundationAgents MetaGPT up to 0.8.1.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00403 Published 2026-04-09 No fix listed CWE-74

TI-2026-03925 CVE-2026-4516 · GHSA-xwvj-r2ph-6xqj

Foundation Agents MetaGPT DataInterpreter write_analysis_code.py injection

MEDIUM 57

A vulnerability was found in Foundation Agents MetaGPT up to 0.8.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00255 Published 2026-03-21 No fix listed CWE-707

TI-2026-03924 CVE-2026-4515 · GHSA-6qq6-2j27-fq65

Foundation Agents MetaGPT operator.py code_generate code injection

MEDIUM 57

A vulnerability has been found in Foundation Agents MetaGPT up to 0.8.1.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00255 Published 2026-03-21 No fix listed CWE-74

TI-2026-00547 CVE-2026-0761 · GHSA-rj73-q8hx-cvvm

Code injection in FoundationAgents MetaGPT

MEDIUM 54

Foundation Agents MetaGPT actionoutput_str_to_mapping Code Injection Remote Code Execution Vulnerability.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02517 Published 2026-01-23 No fix listed CWE-94

TI-2026-00546 CVE-2026-0760 · GHSA-3xp7-v582-9h3c

Deserialization of untrusted data in FoundationAgents MetaGPT

MEDIUM 52

Foundation Agents MetaGPT deserialize_message Deserialization of Untrusted Data Remote Code Execution Vulnerability.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01438 Published 2026-01-23 No fix listed CWE-502

TI-2024-15753 CVE-2024-23750 · GHSA-g7ph-8423-pf4j

MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code because…

HIGH 73

MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code because RunCode.run_script() passes shell metacharacters to subprocess.Popen.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0096 Published 2024-01-22 No fix listed CWE-94

Vulnerabilities

Filters