Is there a public PoC exploit available for CVE-2026-11455?

Yes, a public proof-of-concept exploit is available for CVE-2026-11455. Prioritise patching immediately. EPSS: 0.6%.

MetaGPT CVE-2026-11455

Q: What is the CVSS score of CVE-2026-11455?

CVE-2026-11455 has a CVSS 4.0 base score of 1.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-34985 LOW

Command Injection (CWE-77)

2026-06-07 VulDB

GHSA-h4jg-8v58-57wj

Command Injection Metagpt

1.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.3 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 07, 2026 - 09:22 NVD

MEDIUM LOW

CVSS changed

Jun 07, 2026 - 09:22 NVD

5.0 (MEDIUM) 1.3 (LOW)

Analysis Generated

Jun 07, 2026 - 08:42 vuln.today

DescriptionCVE.org

A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. Affected by this issue is the function check_cmd_exists of the file metagpt/utils/common.py. This manipulation of the argument mermaid.path causes command injection. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Command injection in FoundationAgents MetaGPT through version 0.8.2 allows a remote, low-privileged attacker to execute arbitrary OS commands by manipulating the mermaid.path configuration argument passed to the check_cmd_exists function in metagpt/utils/common.py. A publicly available proof-of-concept (documented on Notion) demonstrates exploitation; however, this is not listed in CISA KEV and the CVSS vector assigns high attack complexity (AC:H), tempering real-world exploitability. The vendor project has not responded to the responsible disclosure filed via GitHub issue #2037, and no patched release is available at time of analysis.

Technical ContextAI

MetaGPT is an AI multi-agent framework (CPE: cpe:2.3:a:foundationagents:metagpt:*:*:*:*:*:*:*:*) that integrates Mermaid diagram rendering into its workflow. The vulnerable code path resides in metagpt/utils/common.py within the check_cmd_exists function, which is responsible for verifying the existence of a command-line binary. The function accepts a mermaid.path configuration value - intended to point to the Mermaid CLI executable - but fails to sanitize or validate the input before incorporating it into a shell invocation. This matches CWE-77 (Improper Neutralization of Special Elements Used in a Command), where untrusted data containing shell metacharacters, command separators (e.g., semicolons, pipes, backticks), or substitution sequences are interpreted by the underlying shell, enabling injection of arbitrary commands. The Mermaid path is a configuration-level value, meaning the attack surface is tied directly to the ability to influence that configuration parameter.

RemediationAI

No vendor-released patch has been identified at time of analysis; the upstream project has not responded to GitHub issue #2037 and remediation level is listed as unknown (RL:X) in the CVSS temporal vector. Organizations should monitor https://github.com/FoundationAgents/MetaGPT/issues/2037 and https://github.com/FoundationAgents/MetaGPT/ for patch availability. In the interim, the most impactful compensating control is to restrict or remove the ability for non-administrative users to set or modify the mermaid.path configuration parameter, as attacker control over this value is the prerequisite for exploitation - note this may limit legitimate customization of Mermaid rendering paths. If Mermaid diagram generation is not actively required in the deployment, disabling this feature entirely eliminates the vulnerable code path with no functional trade-off for non-diagram workflows. If the feature must remain enabled, enforce strict allowlisting of the mermaid.path value to an absolute filesystem path containing only alphanumeric characters and path separators, blocking shell metacharacters at the application configuration layer. Deploying MetaGPT in a containerized or sandboxed environment (e.g., with a restricted seccomp profile or read-only filesystem mounts outside designated directories) would limit the OS-level impact of any successful command injection.