CVE-2026-19060

Received Received - Intake

Code Injection in FoundationAgents MetaGPT

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: VulDB

Description

A vulnerability was identified in FoundationAgents MetaGPT up to 0.8.2. This impacts an unknown function. Such manipulation leads to code injection. The attack needs to be performed locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-19060

Affected Vendors & Products

Vendor	Product	Version / Range
foundationagents	metagtp	to 0.8.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is a code injection flaw in FoundationAgents MetaGPT versions up to 0.8.2. It allows an attacker to inject malicious code into an unknown function of the software. The attack requires local access to the system and an exploit is already publicly available.

Detection Guidance

Detection requires checking for vulnerable versions of FoundationAgents MetaGPT up to 0.8.2. Inspect installed packages or repositories for MetaGPT. Look for unauthorized code execution or injection attempts in logs. No specific commands are provided in the context.

Impact Analysis

If exploited, this vulnerability could allow an attacker to execute arbitrary code on your system with the same privileges as the application. This could lead to unauthorized access, data theft, or further compromise of the affected system.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR or HIPAA. Organizations using affected software may face legal penalties or reputational damage if exploited.

Mitigation Strategies

Immediately update MetaGPT to a version beyond 0.8.2 if available. If no update exists, isolate affected systems to prevent local attacks. Monitor for suspicious activity and restrict local user permissions to limit exploitation.

Hi! I’m here to help you understand CVE-2026-19060. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70