Is there a public PoC exploit available for CVE-2026-10566?

Yes, a public proof-of-concept exploit is available for CVE-2026-10566. Prioritise patching immediately. EPSS: 0.0%.

MetaGPT CVE-2026-10566

Q: What is the CVSS score of CVE-2026-10566?

CVE-2026-10566 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33872 LOW

Deserialization of Untrusted Data (CWE-502)

2026-06-02 VulDB

GHSA-3c3g-7hwg-9qmr

Deserialization Metagpt

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 02, 2026 - 03:22 NVD

MEDIUM LOW

CVSS changed

Jun 02, 2026 - 03:22 NVD

5.3 (MEDIUM) 1.9 (LOW)

Analysis Generated

Jun 02, 2026 - 02:46 vuln.today

DescriptionCVE.org

A weakness has been identified in FoundationAgents MetaGPT up to 0.8.2. This affects the function Message.check_instruct_content of the file metagpt/schema.py. Executing a manipulation of the argument mapping can lead to deserialization. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Unsafe deserialization in FoundationAgents MetaGPT versions up to and including 0.8.2 allows a local low-privileged attacker to achieve confidentiality, integrity, and availability impact by manipulating the mapping argument passed to Message.check_instruct_content in metagpt/schema.py. Publicly available exploit code (POC) exists via a GitHub issue report, elevating practical risk despite the local-only attack vector. No vendor patch has been released - the project was notified via issue report but has not responded, leaving installations without a remediation path.

Technical ContextAI

The vulnerability resides in the Message.check_instruct_content function within metagpt/schema.py, a core schema-handling module of the MetaGPT multi-agent AI framework (CPE: cpe:2.3:a:foundationagents:metagpt:*:*:*:*:*:*:*:*). The root cause is CWE-502 (Deserialization of Untrusted Data): the function processes a mapping argument without sufficient validation before deserializing its contents, allowing attacker-controlled data to be instantiated as arbitrary Python objects. This is a classic unsafe deserialization pattern where object graphs reconstructed from attacker input can invoke dangerous methods during the deserialization lifecycle - a well-understood attack class in Python environments using pickle, yaml.load, or similar mechanisms. The CVSS temporal metric E:P confirms proof-of-concept code exists, and RC:R indicates reasonable but not fully vendor-confirmed confidence in the vulnerability.

RemediationAI

No vendor-released patch has been identified at time of analysis - the FoundationAgents project has not responded to the coordinated disclosure submitted via GitHub issue #2038 (https://github.com/FoundationAgents/MetaGPT/issues/2038). Organizations running MetaGPT should apply the following compensating controls: restrict local system access to MetaGPT installations to only fully trusted users, since exploitation requires low-privileged local access (PR:L); audit and sanitize any code paths that allow external or user-supplied data to reach Message.check_instruct_content in metagpt/schema.py; consider disabling or sandboxing MetaGPT agent workflows that process untrusted message inputs, accepting the trade-off of reduced AI pipeline functionality; and monitor the upstream GitHub repository at https://github.com/FoundationAgents/MetaGPT/ for a patched release. Organizations in multi-user or shared infrastructure deployments should treat this as higher priority given the public POC. Track the VulDB entry at https://vuldb.com/vuln/367673 for patch availability updates.