Command Injection in FoundationAgents MetaGPT

Executive Summary

CVE-2026-11455 is a command injection vulnerability in MetaGPT's Mermaid rendering flow. It occurs because MetaGPT allows users to configure the Mermaid CLI executable path via the mermaid.path field in the configuration file, and this value is used directly in shell commands without proper sanitization.

An attacker who can modify this configuration can inject arbitrary shell commands by including shell metacharacters or commands in the mermaid.path value, leading to arbitrary command execution with the privileges of the user running MetaGPT.

The vulnerability exists in two places: the check_cmd_exists() function in metagpt/utils/common.py and the mermaid_to_file() function in metagpt/utils/mermaid.py, both of which execute shell commands constructed using the unsafe mermaid.path value.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker who has the ability to modify the mermaid.path configuration to execute arbitrary shell commands on the system running MetaGPT.

Such arbitrary command execution can lead to unauthorized actions including data theft, system compromise, or disruption of services depending on the privileges of the MetaGPT user.

However, exploitation is considered difficult and requires a high degree of complexity, and the attack must be initiated remotely.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the MetaGPT configuration file contains an unsafe or manipulated value in the `mermaid.path` field, which is used to specify the Mermaid CLI executable path. Since the vulnerability involves command injection via this path, inspecting the configuration for suspicious shell metacharacters or commands is key.

Additionally, monitoring for unexpected shell command executions or unusual process invocations related to Mermaid diagram generation may help detect exploitation attempts.

Suggested commands to detect potential exploitation or unsafe configuration include:

• Inspect the MetaGPT configuration file (usually `config.yaml` or `~/.metagpt/config2.yaml`) for the `mermaid.path` value: `grep mermaid.path ~/.metagpt/config2.yaml`
• Check for suspicious shell metacharacters or commands in the `mermaid.path` value, such as semicolons (`;`), backticks, or other shell operators.
• Monitor running processes or recent command executions related to Mermaid CLI: `ps aux | grep mmdc` or `ps aux | grep mermaid`
• Audit shell command history or logs for unexpected commands triggered by MetaGPT.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include sanitizing or restricting the `mermaid.path` configuration value to prevent injection of arbitrary shell commands.

Specifically:

• Do not allow untrusted users to modify the `mermaid.path` configuration.
• Manually verify and set the `mermaid.path` to a safe, absolute path to the legitimate Mermaid CLI executable without any shell metacharacters.
• Avoid using shell-based command execution methods that concatenate user input directly into shell commands. Instead, use safer APIs that do not invoke a shell or properly escape inputs.
• Monitor for updates or patches from the MetaGPT project addressing this vulnerability and apply them once available.
• If possible, restrict the permissions of the user running MetaGPT to limit the impact of any potential exploitation.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0