CVE-2026-10566

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-10566

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10566.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-10566

Aliases

Published

2026-06-02T01:45:10.323Z

Modified

2026-07-13T16:43:50.300060289Z

Severity

1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

FoundationAgents MetaGPT schema.py Message.check_instruct_content deserialization

Details

A weakness has been identified in FoundationAgents MetaGPT up to 0.8.2. This affects the function Message.checkinstructcontent of the file metagpt/schema.py. Executing a manipulation of the argument mapping can lead to deserialization. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10566.json",
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-20",
        "CWE-502"
    ]
}

References

Affected packages

Git / github.com/foundationagents/metagpt

Affected ranges

Type

GIT

Repo

https://github.com/foundationagents/metagpt

Events

Introduced

feb2d30364e68cd74193d8f7715c3b90fafd02ec

Last affected

df9bc1858f7d396a7eef5d9718cab7587b63fd62

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0.8.0"
        },
        {
            "last_affected": "0.8.0"
        },
        {
            "introduced": "0.8.1"
        },
        {
            "last_affected": "0.8.1"
        },
        {
            "introduced": "0.8.2"
        },
        {
            "last_affected": "0.8.2"
        }
    ]
}

Affected versions

0.*

0.8.0

0.8.1

0.8.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10566.json"