CVE-2026-79408

CVSS 9.8 (critical) · published 2026-08-31

An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.rebuild_class_views() in metagpt/repo_parser.py.

Weakness: CWE-78

Source: NVD CVE-2026-79408

References

• https://github.com/REYu6/Metagpt-vul/blob/main/CVE-1-MetaGPT-command-injection.md
• https://github.com/REYu6/Metagpt-vul/blob/main/CVE-1-MetaGPT-command-injection.md

Check your software

Connect an AI agent to the Fixlane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.