PYSEC-2026-2637
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/metagpt/PYSEC-2026-2637.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-2637
- Aliases
- Published
- 2026-07-13T15:46:13.813271Z
- Modified
- 2026-07-13T16:32:14.634694994Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
- 1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
- Summary
- FoundationAgents MetaGPT: Deserialization through flawed argument mapping via Message.check_instruct_content()
- Details
-
A weakness has been identified in FoundationAgents MetaGPT up to 0.8.2. This affects the function Message.checkinstructcontent of the file metagpt/schema.py. Executing a manipulation of the argument mapping can lead to deserialization. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2026-10566
- https://github.com/FoundationAgents/MetaGPT/issues/2038
- https://github.com/FoundationAgents/MetaGPT
- https://vuldb.com/cve/CVE-2026-10566
- https://vuldb.com/submit/828301
- https://vuldb.com/vuln/367673
- https://vuldb.com/vuln/367673/cti
- https://pypi.org/project/metagpt
- https://github.com/advisories/GHSA-3c3g-7hwg-9qmr
Affected packages
PyPI / metagpt
Package
- Name
- metagpt
- View open source insights on deps.dev
- Purl
- pkg:pypi/metagpt
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedLast affected0.8.2