CVE-2026-4516

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-4516

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-4516.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-4516

Published

2026-03-21T15:02:11.636Z

Modified

2026-07-15T01:48:56.300007294Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

Foundation Agents MetaGPT DataInterpreter write_analysis_code.py injection

Details

A vulnerability was found in Foundation Agents MetaGPT up to 0.8.1. This vulnerability affects unknown code of the file metagpt/actions/di/writeanalysiscode.py of the component DataInterpreter. The manipulation results in injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Database specific

{
    "cwe_ids": [
        "CWE-707",
        "CWE-74"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4516.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "0.8.0"
                },
                {
                    "last_affected": "0.8.0"
                },
                {
                    "introduced": "0.8.1"
                },
                {
                    "last_affected": "0.8.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "VulDB"
}

References

Affected packages

Git / github.com/foundationagents/metagpt

Affected ranges

Type

GIT

Repo

https://github.com/foundationagents/metagpt

Events

Introduced

Last affected

c036574507e7616c02512e7c8ad88dd847783afa

Database specific

{
    "cpe": "cpe:2.3:a:deepwisdom:metagpt:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.8.1"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v0.*

v0.1.0

v0.2.0

v0.2.1

v0.3.0

v0.8.0

v0.8.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-4516.json"