CVE-2026-11455: FoundationAgents MetaGPT common.py check_cmd_exists command injection
A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. Affected by this issue is the function checkcmdexists of the file metagpt/utils/common.py. This manipulation of the argument mermaid.path causes command injection. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
FoundationAgents MetaGPTfrom your environment.If the component is not required, uninstall or remove MetaGPT (or the vulnerable module) until a patch is released.
- Configuration
Do not allow untrusted input into mermaid.path. Validate or sanitize the value, or set mermaid.path to a fixed safe path so check_cmd_exists is never invoked with user-controlled data to prevent command injection.
FoundationAgents MetaGPT mermaid.path = fixed or sanitized - Compensating control
Restrict network exposure to systems running MetaGPT: apply firewall rules, WAF protections, and limit access to trusted IPs or networks until an upstream fix is available.
- Operational
Audit and monitor logs for signs of exploitation targeting check_cmd_exists (suspicious command execution or attempts to set mermaid.path). Investigate and perform incident response if compromise is suspected, and apply vendor fixes when they become available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11455?
The severity of CVE-2026-11455 is assessed as medium.
How do I fix CVE-2026-11455?
To fix CVE-2026-11455, update FoundationAgents MetaGPT to version 0.8.3 or later.
What type of vulnerability is CVE-2026-11455?
CVE-2026-11455 is a command injection vulnerability.
Can CVE-2026-11455 be exploited remotely?
Yes, CVE-2026-11455 can be exploited remotely.
Which function is affected by CVE-2026-11455?
The function affected by CVE-2026-11455 is check_cmd_exists in metagpt/utils/common.py.