Which versions of Metagpt are affected by CVE-2026-6110?

CVE-2026-6110 is a critical code injection vulnerability in FoundationAgents MetaGPT versions up to 0.8.1 that allows unauthenticated attackers to execute arbitrary code remotely without user…. A patch is available.

Is there a public PoC exploit available for CVE-2026-6110?

Yes, a public proof-of-concept exploit is available for CVE-2026-6110. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-6110?

Within 24 hours: Inventory all deployments of MetaGPT versions 0.8.1 and earlier; isolate affected instances from production networks if patching cannot be completed immediately. Within 7 days: Apply vendor-released patch via pull request #1946 to all MetaGPT installations and verify patching through version confirmation. Within 30 days: Conduct security audit of affected systems for signs of compromise (code execution logs, unexpected process spawning); rotate credentials and keys used by MetaGPT service accounts.

Metagpt CVE-2026-6110

Q: What is the CVSS score of CVE-2026-6110?

CVE-2026-6110 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-21696 MEDIUM

Code Injection (CWE-94)

2026-04-12 VulDB

GHSA-xr7v-m9px-q4qj

RCE Code Injection Metagpt

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 30, 2026 - 14:55 vuln.today

Public exploit code

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Severity Changed

Apr 12, 2026 - 03:22 NVD

HIGH MEDIUM

CVSS changed

Apr 12, 2026 - 03:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Apr 12, 2026 - 02:49 vuln.today

EUVD ID Assigned

Apr 12, 2026 - 02:45 euvd

EUVD-2026-21696

Analysis Generated

Apr 12, 2026 - 02:45 vuln.today

Patch released

Apr 12, 2026 - 02:45 nvd

Patch available

CVE Published

Apr 12, 2026 - 02:00 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was identified in FoundationAgents MetaGPT up to 0.8.1. This affects the function generate_thoughts of the file metagpt/strategy/tot.py of the component Tree-of-Thought Solver. The manipulation leads to code injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Code injection in FoundationAgents MetaGPT versions up to 0.8.1 allows unauthenticated remote attackers to execute arbitrary code via the Tree-of-Thought Solver's generate_thoughts function. Publicly available exploit code exists (GitHub issue #1933), and a vendor-supplied patch is available via pull request #1946. The vulnerability requires no user interaction and has low attack complexity, with confirmed impact to confidentiality, integrity, and availability. CVSS 7.3 (High) reflects moderate impact across all CIA triad elements.

Technical ContextAI

MetaGPT is an AI agent framework that implements advanced reasoning patterns including Tree-of-Thought (ToT) solving. The vulnerable function generate_thoughts in metagpt/strategy/tot.py (CWE-94: Improper Control of Generation of Code) accepts externally-influenced input that is dynamically evaluated or executed without adequate sanitization. Tree-of-Thought is a cognitive framework for LLM reasoning that explores multiple solution paths; the implementation flaw allows attackers to inject malicious code into the thought generation process. The affected CPE (cpe:2.3:a:foundationagents:metagpt) indicates all versions through 0.8.1 contain this flaw. Code injection vulnerabilities of this class typically arise from unsafe use of eval(), exec(), or similar dynamic code execution primitives on attacker-controlled data.

RemediationAI

Apply the vendor-supplied patch available via GitHub pull request at https://github.com/FoundationAgents/MetaGPT/pull/1946, which addresses the code injection vulnerability in the Tree-of-Thought solver. Organizations should review the PR changes, test compatibility with existing workflows, and upgrade to a version incorporating this fix once officially released. Until a tagged release version incorporating PR #1946 is available, development teams may apply the patch manually or build from the patched source branch. As an interim mitigation, restrict network access to MetaGPT instances, implement input validation on any data passed to the Tree-of-Thought solver, and monitor for suspicious code execution patterns. Consider disabling the ToT strategy module entirely if not operationally required. Consult the vendor issue tracker at https://github.com/FoundationAgents/MetaGPT/issues/1933 for updates on formal release timelines.