CVE-2026-79408: Command Injection
Published Aug 31, 2026
·Updated
An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.rebuildclassviews() in metagpt/repoparser.py.
Affected Software
1 affected component
Meta MetaGPT=0.8.1
Event History
Aug 31, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·09:17 PM
Description
Frequently Asked Questions
1
What input must an attacker control to exploit this issue?
An attacker must be able to supply a crafted value for the path argument passed to RepoParser.rebuild_class_views(). The vulnerable handling occurs in metagpt/repo_parser.py.
2
What is the impact of successful exploitation?
Successful exploitation allows arbitrary operating-system commands to be executed in the context of the MetaGPT process.