CVE-2026-11455
FoundationAgents MetaGPT common.py check_cmd_exists command injection
CVSS Score
5.0
EPSS Score
0.6%
EPSS Percentile
71th
A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. Affected by this issue is the function check_cmd_exists of the file metagpt/utils/common.py. This manipulation of the argument mermaid.path causes command injection. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
| CWE | CWE-77 CWE-74 |
| Vendor | foundationagents |
| Product | metagpt |
| Published | Jun 7, 2026 |
| Last Updated | Jun 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for foundationagents metagpt
Be the first to know when new medium vulnerabilities affecting foundationagents metagpt are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
FoundationAgents / MetaGPT
0.8.0 0.8.1 0.8.2
References
vuldb.com: https://vuldb.com/vuln/369074 vuldb.com: https://vuldb.com/vuln/369074/cti vuldb.com: https://vuldb.com/cve/CVE-2026-11455 vuldb.com: https://vuldb.com/submit/828206 github.com: https://github.com/FoundationAgents/MetaGPT/issues/2037 notion.so: https://www.notion.so/asuka39/MetaGPT-Command-Injection-via-Mermaid-path-Configuration-35fe35b8556880b29113c8c1b414a8b2?source=copy_link github.com: https://github.com/FoundationAgents/MetaGPT/
Credits
🔍 ASUKA39 (VulDB User) VulDB CNA Team