CVE-2026-19060: medium-severity vulnerability in FoundationAgents MetaGPT
FoundationAgents MetaGPT code injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 4.8epss 0.2%
A vulnerability was identified in FoundationAgents MetaGPT up to 0.8.2. This impacts an unknown function. Such manipulation leads to code injection. The attack needs to be performed locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
FoundationAgents · MetaGPTpublic PoCs found — 1
cve_referencegist.github.com/tchen200311/3a3bff5a9613dd309db93e4c15079fc6unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — FoundationAgents MetaGPT
In the same product, most dangerous first.
CVE-2026-5972MEDIUMFoundationAgents MetaGPT terminal.py Terminal.run_command os command injectionEPSS 2.7%CVE-2026-5973MEDIUMFoundationAgents MetaGPT common.py get_mime_type os command injectionEPSS 2.6%CVE-2026-5974MEDIUMFoundationAgents MetaGPT terminal.py Bash.run os command injectionEPSS 2.6%CVE-2026-11455LOWFoundationAgents MetaGPT common.py check_cmd_exists command injectionEPSS 1.0%CVE-2026-6110MEDIUMFoundationAgents MetaGPT Tree-of-Thought Solver tot.py generate_thoughts code injectionEPSS 0.4%CVE-2026-5971MEDIUMFoundationAgents MetaGPT XML action_node.py ActionNode.xml_fill eval injectionEPSS 0.4%
References
https://gist.github.com/tchen200311/3a3bff5a9613dd309db93e4c15079fc6https://gist.github.com/tchen200311/fe1acfbaa29652429309c2dad1aa2aedhttps://vuldb.com/cve/CVE-2026-19060https://vuldb.com/submit/864279https://vuldb.com/submit/864282https://vuldb.com/vuln/386517https://vuldb.com/vuln/386517/cti