CVE-2026-4516

2.1 lowEPSS 0.2%

A vulnerability was found in Foundation Agents MetaGPT up to 0.8.1. This vulnerability affects unknown code of the file metagpt/actions/di/write_analysis_code.py of the component DataInterpreter. The manipulation results in injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity

CVSS 4.0

2.1 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

6.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-10-31)
CWEs: CWE-74, CWE-707
Published: 2026-03-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

deepwisdom:metagpt

References

https://github.com/Ka7arotto/cve/blob/main/MetaGPT-rce2.md
https://vuldb.com/?ctiid.352081
https://vuldb.com/?id.352081
https://vuldb.com/?submit.773930

Check your stack JSON