OS Command Injection Vulnerability in MetaGPT by Meta
CVE-2026-79408

9.8CRITICAL

Key Information:

Vendor

Meta

Status
MetaGPT
Vendor
CVE Published:
31 August 2026

What is CVE-2026-79408?

An OS command injection vulnerability in MetaGPT 0.8.1 allows attackers to exploit the path argument of the RepoParser.rebuild_class_views() function, leading to the potential execution of arbitrary system commands. This vulnerability poses significant security risks, enabling unauthorized access to system resources. Proper input validation and secure coding practices are essential to mitigate such risks.

References

https://github.com/REYu6/Metagpt-vul/blob/main/CVE-1-Meta...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.