EUVD-2026-54282
GHSA-5j3c-8q7x-589c
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector requires existing system access; PR:L reflects low-privilege requirement; no scope change; limited C/I/A impact consistent with CVSS 4.0 VC:L/VI:L/VA:L.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was found in FoundationAgents MetaGPT up to 0.8.2. The impacted element is the function DataInterpreter of the file metagpt/roles/di/data_interpreter.py. The manipulation results in code injection. The attack must be initiated from a local position. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Code injection in MetaGPT's DataInterpreter role (versions 0.8.0-0.8.2) enables a local low-privileged user to inject and execute arbitrary code through the DataInterpreter function in metagpt/roles/di/data_interpreter.py. A public proof-of-concept exploit is available via GitHub Gist, though the CVSS 4.0 score of 1.9 reflects the constrained blast radius: local-only access, low-privilege requirement, and limited impact (low C/I/A, no scope change to subsequent systems). The vendor did not respond to pre-disclosure notification, leaving patch status unresolved.
Technical ContextAI
MetaGPT is an open-source multi-agent AI framework (FoundationAgents/MetaGPT) that orchestrates LLM-powered agents for software development tasks. The DataInterpreter role is designed to interpret and dynamically execute code as part of its agentic pipeline - making it an inherently high-risk execution surface where user-supplied or agent-generated content drives code execution. CWE-74 (Injection) indicates that input passed to the DataInterpreter function in metagpt/roles/di/data_interpreter.py is not adequately sanitized or sandboxed before execution, allowing injected code to run within the MetaGPT process context. Affected versions span 0.8.0 through 0.8.2 per EUVD-2026-54282. No CPE string was provided in the source intelligence.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to responsible disclosure, and no fixed version is confirmed. Organizations using MetaGPT 0.8.0-0.8.2 should check the upstream GitHub repository (FoundationAgents/MetaGPT) for any commits or releases beyond 0.8.2 that may address this issue. As a compensating control, restrict local system access to MetaGPT hosts to trusted users only, since exploitation requires local low-privilege access. If MetaGPT is deployed in a shared or multi-user environment (e.g., a Jupyter-style server), isolate it in a Docker container with restricted Linux capabilities and a read-only filesystem where possible - note this may impact DataInterpreter functionality that depends on file write access. Auditing or intercepting inputs to the DataInterpreter pipeline is an additional control but operationally complex given the agentic nature of the framework. The public PoC at https://gist.github.com/tchen200311/6610c1bf4075b63fd13c51f83fef7a15 can be used to verify exposure.
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today