Foundationagents
Monthly
Command injection in FoundationAgents MetaGPT through version 0.8.2 allows a remote, low-privileged attacker to execute arbitrary OS commands by manipulating the mermaid.path configuration argument passed to the check_cmd_exists function in metagpt/utils/common.py. A publicly available proof-of-concept (documented on Notion) demonstrates exploitation; however, this is not listed in CISA KEV and the CVSS vector assigns high attack complexity (AC:H), tempering real-world exploitability. The vendor project has not responded to the responsible disclosure filed via GitHub issue #2037, and no patched release is available at time of analysis.
Unsafe deserialization in FoundationAgents MetaGPT versions up to and including 0.8.2 allows a local low-privileged attacker to achieve confidentiality, integrity, and availability impact by manipulating the `mapping` argument passed to `Message.check_instruct_content` in `metagpt/schema.py`. Publicly available exploit code (POC) exists via a GitHub issue report, elevating practical risk despite the local-only attack vector. No vendor patch has been released - the project was notified via issue report but has not responded, leaving installations without a remediation path.
Server-side request forgery (SSRF) in FoundationAgents MetaGPT up to version 0.8.1 allows authenticated remote attackers to conduct arbitrary requests via manipulation of the img_url_or_b64 parameter in the decode_image function of metagpt/utils/common.py. Publicly available exploit code exists, and a vendor patch has been released. The vulnerability carries a CVSS score of 6.3 with low confidentiality, integrity, and availability impact, but requires low-level authentication to exploit.
Code injection in FoundationAgents MetaGPT versions up to 0.8.1 allows unauthenticated remote attackers to execute arbitrary code via the Tree-of-Thought Solver's generate_thoughts function. Publicly available exploit code exists (GitHub issue #1933), and a vendor-supplied patch is available via pull request #1946. The vulnerability requires no user interaction and has low attack complexity, with confirmed impact to confidentiality, integrity, and availability. CVSS 7.3 (High) reflects moderate impact across all CIA triad elements.
Cross-site request forgery in FoundationAgents MetaGPT through version 0.8.1 allows unauthenticated remote attackers to perform unauthorized actions via the evaluateCode function in the Mineflayer HTTP API component. The vulnerability requires user interaction (UI:R) and has limited integrity impact, but publicly available exploit code exists and the vendor has not yet responded to early notification.
Remote command injection in FoundationAgents MetaGPT versions up to 0.8.1 allows unauthenticated network attackers to execute arbitrary OS commands via the Bash.run function in metagpt/tools/libs/terminal.py. The vulnerability has a CVSS score of 6.9 with network-accessible attack vector and low complexity, and matches CISA SSVC criteria for partial technical impact with automatable exploitation; a proof-of-concept exists but no confirmed active exploitation has been reported.
Remote command injection in FoundationAgents MetaGPT versions 0.8.0 and 0.8.1 via the get_mime_type function in metagpt/utils/common.py allows unauthenticated attackers to execute arbitrary OS commands over the network with low complexity. Publicly available exploit code exists, and a patch pull request has been submitted but not yet merged by the vendor, creating an active vulnerability window for deployed instances.
Remote code execution in FoundationAgents MetaGPT up to version 0.8.1 allows unauthenticated attackers to execute arbitrary OS commands via improper input validation in the Terminal.run_command function. The vulnerability exploits command injection in metagpt/tools/libs/terminal.py and has publicly available exploit code; patch commit d04ffc8dc67903e8b327f78ec121df5e190ffc7b is available from the vendor.
Remote code injection in FoundationAgents MetaGPT up to version 0.8.1 allows unauthenticated attackers to execute arbitrary code via improper neutralization of directives in the ActionNode.xml_fill XML handler function. The vulnerability has publicly available exploit code and affects the dynamic code evaluation mechanism in metagpt/actions/action_node.py, enabling attackers to manipulate XML input for code injection with low complexity and no authentication required.
Code injection in FoundationAgents MetaGPT versions up to 0.8.1 allows unauthenticated remote attackers to execute arbitrary code through the check_solution function in HumanEvalBenchmark and MBPPBenchmark components. The vulnerability requires no user interaction and enables unauthorized access, data modification, and service disruption. Publicly available exploit code exists, disclosed via GitHub issue #1942. Vendor has not responded to early disclosure via pull request #1988 at time of analysis.
Command injection in FoundationAgents MetaGPT through version 0.8.2 allows a remote, low-privileged attacker to execute arbitrary OS commands by manipulating the mermaid.path configuration argument passed to the check_cmd_exists function in metagpt/utils/common.py. A publicly available proof-of-concept (documented on Notion) demonstrates exploitation; however, this is not listed in CISA KEV and the CVSS vector assigns high attack complexity (AC:H), tempering real-world exploitability. The vendor project has not responded to the responsible disclosure filed via GitHub issue #2037, and no patched release is available at time of analysis.
Unsafe deserialization in FoundationAgents MetaGPT versions up to and including 0.8.2 allows a local low-privileged attacker to achieve confidentiality, integrity, and availability impact by manipulating the `mapping` argument passed to `Message.check_instruct_content` in `metagpt/schema.py`. Publicly available exploit code (POC) exists via a GitHub issue report, elevating practical risk despite the local-only attack vector. No vendor patch has been released - the project was notified via issue report but has not responded, leaving installations without a remediation path.
Server-side request forgery (SSRF) in FoundationAgents MetaGPT up to version 0.8.1 allows authenticated remote attackers to conduct arbitrary requests via manipulation of the img_url_or_b64 parameter in the decode_image function of metagpt/utils/common.py. Publicly available exploit code exists, and a vendor patch has been released. The vulnerability carries a CVSS score of 6.3 with low confidentiality, integrity, and availability impact, but requires low-level authentication to exploit.
Code injection in FoundationAgents MetaGPT versions up to 0.8.1 allows unauthenticated remote attackers to execute arbitrary code via the Tree-of-Thought Solver's generate_thoughts function. Publicly available exploit code exists (GitHub issue #1933), and a vendor-supplied patch is available via pull request #1946. The vulnerability requires no user interaction and has low attack complexity, with confirmed impact to confidentiality, integrity, and availability. CVSS 7.3 (High) reflects moderate impact across all CIA triad elements.
Cross-site request forgery in FoundationAgents MetaGPT through version 0.8.1 allows unauthenticated remote attackers to perform unauthorized actions via the evaluateCode function in the Mineflayer HTTP API component. The vulnerability requires user interaction (UI:R) and has limited integrity impact, but publicly available exploit code exists and the vendor has not yet responded to early notification.
Remote command injection in FoundationAgents MetaGPT versions up to 0.8.1 allows unauthenticated network attackers to execute arbitrary OS commands via the Bash.run function in metagpt/tools/libs/terminal.py. The vulnerability has a CVSS score of 6.9 with network-accessible attack vector and low complexity, and matches CISA SSVC criteria for partial technical impact with automatable exploitation; a proof-of-concept exists but no confirmed active exploitation has been reported.
Remote command injection in FoundationAgents MetaGPT versions 0.8.0 and 0.8.1 via the get_mime_type function in metagpt/utils/common.py allows unauthenticated attackers to execute arbitrary OS commands over the network with low complexity. Publicly available exploit code exists, and a patch pull request has been submitted but not yet merged by the vendor, creating an active vulnerability window for deployed instances.
Remote code execution in FoundationAgents MetaGPT up to version 0.8.1 allows unauthenticated attackers to execute arbitrary OS commands via improper input validation in the Terminal.run_command function. The vulnerability exploits command injection in metagpt/tools/libs/terminal.py and has publicly available exploit code; patch commit d04ffc8dc67903e8b327f78ec121df5e190ffc7b is available from the vendor.
Remote code injection in FoundationAgents MetaGPT up to version 0.8.1 allows unauthenticated attackers to execute arbitrary code via improper neutralization of directives in the ActionNode.xml_fill XML handler function. The vulnerability has publicly available exploit code and affects the dynamic code evaluation mechanism in metagpt/actions/action_node.py, enabling attackers to manipulate XML input for code injection with low complexity and no authentication required.
Code injection in FoundationAgents MetaGPT versions up to 0.8.1 allows unauthenticated remote attackers to execute arbitrary code through the check_solution function in HumanEvalBenchmark and MBPPBenchmark components. The vulnerability requires no user interaction and enables unauthorized access, data modification, and service disruption. Publicly available exploit code exists, disclosed via GitHub issue #1942. Vendor has not responded to early disclosure via pull request #1988 at time of analysis.