VulnSocial

CVE-2026-0761Disclosure(deepwisdom / metagpt)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Foundation Agents MetaGPT actionoutput_str_to_mapping Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foundation Agents MetaGPT. Authentication is not required to exploit this vulnerability. The specific flaw exists within the actionoutput_str_to_mapping function. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28124.

deepwisdom CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-94

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • metagpt

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
deepwisdom
Products
metagpt

1 version affected across 1 product

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-01-28: 1Technical Details · 2026-01-28: 101-28
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • TheZDIBugs@TheZDIBugs
    Disclosure

    [ZDI-26-027|CVE-2026-0761] (0Day) Foundation Agents MetaGPT actionoutput_str_to_mapping Code Injection Remote Code Execution Vulnerability (CVSS 9.8; Credit: Peter Girnus (@gothburz) and Brandon Niemczyk of Trend Zero Day Initiative) https://www.zerodayinitiative.com/advisories/ZDI-26-027/

    Post summary

    A newly disclosed CVE‑2026‑0761 affecting Foundation Agents MetaGPT via code injection and remote code execution was identified with a CVSS score of 9.8. No proof‑of‑concept, exploit code, active exploitation, or patch details are provided.

    00012645
    5.3K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appdeepwisdommetagpt0.8.1--

Explore more

Back to dashboarddeepwisdom CVEsmetagpt vulnerabilities