VulnSocial

CVE-2026-0760Disclosure(deepwisdom / metagpt)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Foundation Agents MetaGPT deserialize_message Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foundation Agents MetaGPT. Authentication is not required to exploit this vulnerability. The specific flaw exists within the deserialize_message function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28121.

deepwisdom CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-502

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • metagpt

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
deepwisdom
Products
metagpt

1 version affected across 1 product

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-01-28: 1Technical Details · 2026-01-28: 101-28
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • TheZDIBugs@TheZDIBugs
    Disclosure

    [ZDI-26-026|CVE-2026-0760] (0Day) Foundation Agents MetaGPT deserialize_message Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 9.8; Credit: Peter Girnus (@gothburz), Brandon Niemczyk of Trend Zero Day Initiative) https://www.zerodayinitiative.com/advisories/ZDI-26-026/

    Post summary

    The advisory announces CVE‑2026‑0760, a 0-day remote code execution flaw in MetaGPT’s deserialize_message function with a CVSS score of 9.8; no PoC, exploitation evidence, or patch information is provided.

    00031574
    5.3K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appdeepwisdommetagpt0.8.1--

Explore more

Back to dashboarddeepwisdom CVEsmetagpt vulnerabilities