CVE-2026-19060 in MetaGPT
Summary
by MITRE • 08/07/2026
A vulnerability was identified in FoundationAgents MetaGPT up to 0.8.2. This impacts an unknown function. Such manipulation leads to code injection. The attack needs to be performed locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/07/2026
This vulnerability affects FoundationAgents MetaGPT version 0.8.2 and earlier, representing a critical code injection flaw that can be exploited through local manipulation of an unknown function within the system. The vulnerability demonstrates characteristics consistent with CWE-94, which describes improper control of generation of code, where attacker-controlled data can influence code execution paths. The local attack requirement suggests this could be leveraged by malicious actors who already have access to the system or by attackers who have achieved initial compromise through other means. The fact that a public exploit exists significantly elevates the risk profile as it removes the need for advanced exploitation techniques and makes the vulnerability immediately actionable by threat actors.
The operational impact of this vulnerability extends beyond simple code execution, potentially allowing attackers to escalate privileges, establish persistent access, or exfiltrate sensitive data from systems running affected versions. Given that MetaGPT is designed for automated agent operations and potentially sensitive task execution, such a flaw could enable unauthorized manipulation of automated workflows, system commands, or data processing pipelines. The lack of vendor response despite early disclosure indicates potential security mismanagement or delayed remediation processes that leave organizations exposed to active exploitation.
Security practitioners should immediately implement mitigations including restricting local access to affected systems, applying patch updates when available, and monitoring for suspicious code execution patterns or unauthorized local activities. The vulnerability aligns with ATT&CK technique T1059 which covers command and scripting interpreter, suggesting that exploitation could involve executing malicious commands through the compromised function. Organizations should also consider network segmentation and access controls to limit potential lateral movement if local compromise occurs. The absence of vendor response raises concerns about long-term support and security posture of the platform, potentially warranting alternative solution evaluation or immediate migration away from affected versions to prevent sustained exposure to this code injection vulnerability.