CVE-2026-4515: Foundation Agents MetaGPT operator.py code_generate code injection
A vulnerability has been found in Foundation Agents MetaGPT up to 0.8.1. This affects the function codegenerate of the file metagpt/ext/aflow/scripts/operator.py. The manipulation leads to code injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4515?
CVE-2026-4515 has a high severity level due to its potential for code injection attacks.
How do I fix CVE-2026-4515?
To fix CVE-2026-4515, update Foundation Agents MetaGPT to version 0.8.2 or later.
What versions are affected by CVE-2026-4515?
CVE-2026-4515 affects Foundation Agents MetaGPT versions up to and including 0.8.1.
What is the impact of exploiting CVE-2026-4515?
Exploiting CVE-2026-4515 allows an attacker to perform arbitrary code injection through the code_generate function.
Is there a workaround for CVE-2026-4515?
Currently, the recommended mitigation for CVE-2026-4515 is to upgrade to a secured version rather than relying on a workaround.