External risk intelligence

MetaGPT OS Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-79408

MetaGPT is a software framework and library used for multi-agent systems and development automation. It is typically utilized within developer environments, CI/CD pipelines, or as an internal library rather than as an internet-facing service, making public exposure uncommon.

OS Command Injection

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a software framework used for development automation. This issue could allow unauthorized command execution on affected systems if exploited. While the primary concern is confirming if this technology is in use and exposed, understanding the nature of such vulnerabilities is important for maintaining a secure operational environment.

Commands can be run by attackers.
Affects developer automation tools.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can execute arbitrary commands on a system running MetaGPT by exploiting a vulnerability in the `RepoParser.rebuild_class_views()` function. This is possible if an attacker can influence the `path` argument passed to this function. Successful exploitation allows an attacker to achieve code execution with the privileges of the running process.

Unauthenticated network access required.
Specially crafted path argument triggers vulnerability.
Arbitrary command execution possible.

Live Threat

Current exploitation, exposure, and threat context

A vulnerability in MetaGPT could allow an unauthenticated attacker to execute arbitrary commands on the system by providing a malicious path argument to a specific function. This could affect the integrity and availability of the system running MetaGPT.

System commands could be executed.
Malicious path argument may trigger execution.
Compromised system integrity and availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for application development, infrastructure, and security should prioritize addressing this OS command injection vulnerability. The first practical step involves identifying all instances of the affected software, confirming their exposure and criticality, and then assigning ownership for remediation planning.

Application and platform teams own this issue.
Verify all deployments and network exposure.
Plan remediation based on business risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MetaGPT?

MetaGPT is a framework and software library designed for building multi-agent systems and automating development tasks. It functions as a specialized toolset that developers integrate into their own projects, CI/CD pipelines, or internal environments to streamline complex coding workflows.

What is the OS command injection weakness in CVE-2026-79408?

This vulnerability, classified as CWE-78, occurs when an application improperly filters input before passing it to a system shell. In this case, the flaw allows an attacker to inject their own malicious system commands into the code, which the operating system then executes with the same permissions as the MetaGPT process.

How is this command injection triggered?

The flaw is triggered when the `RepoParser.rebuild_class_views()` function processes a specially crafted string through its `path` argument. Note that simply having MetaGPT installed is not enough; the bug only activates if an attacker can successfully provide this malicious input to that specific function within the software.

Do I need to worry about CVE-2026-79408?

Halo Surface Signal indicates that MetaGPT is typically used as an internal library or within developer-only environments, making internet-facing exposure uncommon. You should be most concerned if your specific implementation exposes the `RepoParser` function to untrusted external network traffic.

When should I start fixing this?

Prioritize this issue by first locating all systems running MetaGPT in your environment. Once you have identified these instances, determine if any of them are reachable from the network. After assessing this footprint, assign the task to your application or platform teams to plan and apply the necessary updates.

References

github.com/REYu6/Metagpt-vul/blob/main/CVE-1-MetaGPT-command-inj…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.