CVE-2026-11455

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-11455

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11455.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-11455

Published

2026-06-07T07:00:12.675Z

Modified

2026-07-08T07:09:44.788343801Z

Severity

1.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

FoundationAgents MetaGPT common.py check_cmd_exists command injection

Details

A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. Affected by this issue is the function checkcmdexists of the file metagpt/utils/common.py. This manipulation of the argument mermaid.path causes command injection. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-74",
        "CWE-77"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11455.json"
}

References

Affected packages

Git / github.com/foundationagents/metagpt

Affected ranges

Type

GIT

Repo

https://github.com/foundationagents/metagpt

Events

Introduced

feb2d30364e68cd74193d8f7715c3b90fafd02ec

Last affected

df9bc1858f7d396a7eef5d9718cab7587b63fd62

Database specific

{
    "extracted_events": [
        {
            "introduced": "0.8.0"
        },
        {
            "last_affected": "0.8.0"
        },
        {
            "introduced": "0.8.1"
        },
        {
            "last_affected": "0.8.1"
        },
        {
            "introduced": "0.8.2"
        },
        {
            "last_affected": "0.8.2"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*

0.8.0

0.8.1

0.8.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11455.json"