CVE-2026-11455Disclosure

LOWCVSS 1.3 · LOW

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. Affected by this issue is the function check_cmd_exists of the file metagpt/utils/common.py. This manipulation of the argument mermaid.path causes command injection. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-74CWE-77

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked 1d ago at 2 mentions (2026-06-07); latest day: 1
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-07	2	Disclosure2
2026-06-08	1	Disclosure1

Full discourse3 posts

ThreatCluster@threatcluster135d
Disclosure
Two newly listed flaws CVE-2026-11478 in kokke tiny-regex-c and CVE-2026-11455 in FoundationAgents MetaGPT allow local regex complexity abuse and remote command injection with public exploits, according to NVD data. https://threatcluster.io/cluster/new-vulnerabilities-disclosed-cve-2026-11478-and-cve-2026-11-da369dff
Post summary
The text announces two newly listed CVEs, describing their technical impact (regex complexity abuse and remote command injection), but it does not provide PoC code, exploit tools, or evidence of active exploitation.
0000052
317 followersView on X
CVE@CVEnew136d
Disclosure
CVE-2026-11455 A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. Affected by this issue is the function check_cmd_exists of the file metagpt/utils/common.py. T… https://www.cve.org/CVERecord?id=CVE-2026-11455
Post summary
A new CVE (2026-11455) is disclosed for MetaGPT, affecting the check_cmd_exists function; no PoC, exploit code, active exploitation, patch, or false‑positive claim is mentioned.
00000160
57.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds136d
Disclosure
CVE-2026-11455 Command Injection in FoundationAgents MetaGPT Up to 0.8.2 via Mermaid Path https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-11455
Post summary
The text announces a command‑injection vulnerability (CVE‑2026‑11455) in FoundationAgents MetaGPT up to version 0.8.2, triggered via a Mermaid path, with no evidence of exploits or patch information.
0000041
4.0K followersView on X

Explore more

Back to dashboard