CVE-2026-19060
FoundationAgents MetaGPT code injection
- State
- Published
- Severity
- 4.8 Medium
- Published
- Aug 6, 2026
- Updated
- Aug 7, 2026
- Reserved
- Aug 6, 2026
Description
A vulnerability was identified in FoundationAgents MetaGPT up to 0.8.2. This impacts an unknown function. Such manipulation leads to code injection. The attack needs to be performed locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 4.8 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 5.3 Medium | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 4.3 Medium | AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
MetaGPTFoundationAgents |
|
References
- VDB-386517 | FoundationAgents MetaGPT code injectionvdb-entry
- VDB-386517 | CTI Indicators (IOB, IOC, TTP)signaturepermissions-required
- CVE-2026-19060 | CVE Analysis and Reportthird-party-advisory
- Submit #864279 | FoundationAgents MetaGPT 1.0.0 Code Injectionthird-party-advisory
- Submit #864282 | FoundationAgents MetaGPT 1.0.0 Code Injection (Duplicate)third-party-advisory
- https://gist.github.com/tchen200311/fe1acfbaa29652429309c2dad1aa2aedrelated
- https://gist.github.com/tchen200311/3a3bff5a9613dd309db93e4c15079fc6exploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.