CVE-2026-11455
Command Injection in FoundationAgents MetaGPT
Publication date: 2026-06-07
Last updated on: 2026-06-07
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| foundationagents | metagpt | to 0.8.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-11455 is a command injection vulnerability in MetaGPT's Mermaid rendering flow. It occurs because MetaGPT allows users to configure the Mermaid CLI executable path via the mermaid.path field in the configuration file, and this value is used directly in shell commands without proper sanitization.
An attacker who can modify this configuration can inject arbitrary shell commands by including shell metacharacters or commands in the mermaid.path value, leading to arbitrary command execution with the privileges of the user running MetaGPT.
The vulnerability exists in two places: the check_cmd_exists() function in metagpt/utils/common.py and the mermaid_to_file() function in metagpt/utils/mermaid.py, both of which execute shell commands constructed using the unsafe mermaid.path value.
How can this vulnerability impact me? :
This vulnerability can allow an attacker who has the ability to modify the mermaid.path configuration to execute arbitrary shell commands on the system running MetaGPT.
Such arbitrary command execution can lead to unauthorized actions including data theft, system compromise, or disruption of services depending on the privileges of the MetaGPT user.
However, exploitation is considered difficult and requires a high degree of complexity, and the attack must be initiated remotely.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the MetaGPT configuration file contains an unsafe or manipulated value in the `mermaid.path` field, which is used to specify the Mermaid CLI executable path. Since the vulnerability involves command injection via this path, inspecting the configuration for suspicious shell metacharacters or commands is key.
Additionally, monitoring for unexpected shell command executions or unusual process invocations related to Mermaid diagram generation may help detect exploitation attempts.
Suggested commands to detect potential exploitation or unsafe configuration include:
- Inspect the MetaGPT configuration file (usually `config.yaml` or `~/.metagpt/config2.yaml`) for the `mermaid.path` value: `grep mermaid.path ~/.metagpt/config2.yaml`
- Check for suspicious shell metacharacters or commands in the `mermaid.path` value, such as semicolons (`;`), backticks, or other shell operators.
- Monitor running processes or recent command executions related to Mermaid CLI: `ps aux | grep mmdc` or `ps aux | grep mermaid`
- Audit shell command history or logs for unexpected commands triggered by MetaGPT.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include sanitizing or restricting the `mermaid.path` configuration value to prevent injection of arbitrary shell commands.
Specifically:
- Do not allow untrusted users to modify the `mermaid.path` configuration.
- Manually verify and set the `mermaid.path` to a safe, absolute path to the legitimate Mermaid CLI executable without any shell metacharacters.
- Avoid using shell-based command execution methods that concatenate user input directly into shell commands. Instead, use safer APIs that do not invoke a shell or properly escape inputs.
- Monitor for updates or patches from the MetaGPT project addressing this vulnerability and apply them once available.
- If possible, restrict the permissions of the user running MetaGPT to limit the impact of any potential exploitation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.