EUVD-2026-54301
GHSA-r9xf-wghf-rmpc
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only attack vector and low privileges required per CVSS 4.0 source vector; impact uniformly low with no scope change to other systems.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was identified in FoundationAgents MetaGPT up to 0.8.2. This impacts an unknown function. Such manipulation leads to code injection. The attack needs to be performed locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Code injection in FoundationAgents MetaGPT versions 0.8.0 through 0.8.2 allows a local attacker with low-privilege credentials to inject and execute arbitrary code within the application's process context. The vulnerability (CWE-74) affects an unspecified function and produces low-severity confidentiality, integrity, and availability impacts with no lateral scope change to other systems. A public exploit is available via GitHub gists linked in the CVE references; no active exploitation has been confirmed by CISA KEV, and the CVSS 4.0 base score of 1.9 reflects the constrained local-only attack surface.
Technical ContextAI
MetaGPT is a multi-agent AI framework by FoundationAgents that orchestrates LLM-driven agents to collaboratively solve software engineering tasks; it is primarily a Python framework commonly run in developer or research environments. CWE-74 (Injection) covers flaws where attacker-controlled data is not properly neutralized before being processed in a downstream command or code-execution context. In LLM agent frameworks like MetaGPT, dynamic code generation and execution (e.g., Python eval/exec calls, subprocess invocations, or templated code runners) are architectural patterns that commonly introduce injection surfaces when user or agent-supplied input is insufficiently validated. The specific vulnerable function is not identified in any available source. Affected versions per EUVD (EUVD-2026-54301) are MetaGPT 0.8.0, 0.8.1, and 0.8.2; no CPE strings were included in the provided intelligence.
RemediationAI
No vendor-released patch has been identified at the time of analysis; the vendor did not respond to the coordinated disclosure by cna@vuldb.com, and no fix version appears in any available reference. Users of MetaGPT 0.8.0 through 0.8.2 should monitor the FoundationAgents upstream repository for any security releases and apply updates promptly when available. As a primary compensating control, restrict local system access to MetaGPT processes exclusively to trusted users - since PR:L is required, removing unnecessary user accounts and enforcing host-level least-privilege access directly reduces the attacker pool with no functional trade-off. Running MetaGPT inside an isolated execution environment such as a container or virtual machine limits code injection impact to that sandboxed context and prevents any broader host compromise. Additionally, auditing and restricting any input pathways that feed into dynamic code execution functions (eval, exec, subprocess calls) within the local MetaGPT installation can serve as a manual hardening measure, though this requires framework-level familiarity and may affect agent functionality.
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today