MetaGPT has an eval injection via a cross-site request forgery attack

CAO 8.8CVE-2026-6109 · GHSA-w287-wwhf-95vv · PYSEC-2026-2643 · Công bố 12/04/2026 · cập nhật 26/10/2026

Tóm tắt nhanh

CVE-2026-6109 là lỗ hổng mức CAO (CVSS 8.8) ảnh hưởng metagpt, metagpt (deepwisdom).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.22%, cao hơn 13.0% các lỗ hổng khác.
Chưa có phiên bản vá trong dữ liệu: theo dõi khuyến cáo của nhà cung cấp ở phần Tham khảo.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
metagpt PyPI	`≤ 0.8.2`	Chưa có bản vá
metagpt deepwisdom	`≤ 0.8.1`	Chưa có bản vá

Mô tả

A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. The impacted element is the function evaluateCode of the file metagpt/environment/minecraft/mineflayer/index.js of the component Mineflayer HTTP API. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Mô tả của NVD

A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.1. The impacted element is the function evaluateCode of the file metagpt/environment/minecraft/mineflayer/index.js of the component Mineflayer HTTP API. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.