Which versions of Metagpt are affected by CVE-2026-4515?

Organizations using Foundation Agents MetaGPT should be aware of moderate risk from CVE-2026-4515, a code injection vulnerability rated CVSS 6.3.

Is there a public PoC exploit available for CVE-2026-4515?

Yes, a public proof-of-concept exploit is available for CVE-2026-4515. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4515?

Within 30 days: Identify affected systems running Foundation Agents MetaGPT and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Metagpt CVE-2026-4515

Q: What is the CVSS score of CVE-2026-4515?

CVE-2026-4515 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14250 LOW

Code Injection (CWE-94)

2026-03-21 VulDB

GHSA-6qq6-2j27-fq65

RCE Code Injection Metagpt

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Mar 23, 2026 - 14:31 vuln.today

Public exploit code

EUVD ID Assigned

Mar 21, 2026 - 11:45 euvd

EUVD-2026-14250

Analysis Generated

Mar 21, 2026 - 11:45 vuln.today

CVE Published

Mar 21, 2026 - 11:32 nvd

MEDIUM 6.3

DescriptionCVE.org

A vulnerability has been found in Foundation Agents MetaGPT up to 0.8.1. This affects the function code_generate of the file metagpt/ext/aflow/scripts/operator.py. The manipulation leads to code injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

A code injection vulnerability exists in Foundation Agents MetaGPT versions up to 0.8.1 within the code_generate function of metagpt/ext/aflow/scripts/operator.py, allowing authenticated remote attackers to execute arbitrary code. The vulnerability is classified as CWE-94 (improper control of generation of code) and carries a CVSS score of 6.3 with network-based attack vector requiring low privileges. A public exploit has been disclosed on GitHub, and the vendor has not responded to early disclosure attempts, elevating the practical risk despite the moderate CVSS rating.

Technical ContextAI

The vulnerability resides in the code generation mechanism of MetaGPT, an AI-driven multi-agent framework used for software development automation. The affected component (metagpt/ext/aflow/scripts/operator.py) contains the code_generate function which fails to properly sanitize or validate user-supplied input before processing it as executable code. This represents a classic code injection flaw (CWE-94: Improper Control of Generation of Code) where attacker-controlled data is incorporated into dynamically generated code without adequate safeguards. MetaGPT serves as an agent orchestration platform, and compromising the code generation pipeline allows attackers to inject malicious instructions that will be executed within the framework's runtime context. The CPE designation (cpe:2.3:a:foundation_agents:metagpt:*:*:*:*:*:*:*:*) indicates all versions up to and including 0.8.1 are vulnerable.

RemediationAI

Immediately upgrade Foundation Agents MetaGPT to a version newer than 0.8.1; however, verify that a patched release is available from the vendor before upgrading, as the vendor has not publicly confirmed a fix timeline. If a patched version is unavailable, implement network-level access controls to restrict access to the metagpt/ext/aflow/scripts/operator.py endpoint to trusted sources only, and disable the code_generate function if it is not required for your operational use case. Additionally, apply principle of least privilege by ensuring MetaGPT processes run with minimal required permissions and operate in isolated environments (containers or VMs) to limit the blast radius of code injection exploitation. Monitor for suspicious code generation patterns and consider implementing input validation filters at the application level if feasible. Until patching, treat any unauthenticated or semi-trusted access to MetaGPT instances as high-risk and restrict to internal networks only.