Foundation Agents MetaGPT actionoutput_str_to_mapping コードインジェクションによるリモートコード実行の脆弱性

The impact of CVE-2026-0761 is severe. An attacker can leverage the lack of input validation in the actionoutputstrto_mapping function to inject and execute malicious Python code. This code will run within the context of the MetaGPT service account, potentially granting the attacker full control over the affected system. This could lead to data breaches, system compromise, and further lateral movement within the network. The absence of authentication requirements significantly lowers the barrier to exploitation, making this a high-priority vulnerability.

Organizations deploying MetaGPT in production environments, particularly those with limited network segmentation or inadequate access controls, are at significant risk. Systems running MetaGPT as a service account with elevated privileges are especially vulnerable, as the attacker would inherit those privileges upon successful exploitation.

• python / server:

import psutil
for proc in psutil.process_iter(['pid', 'name', 'cmdline']):
    if 'metagpt' in proc.info['name'].lower():
        print(f'MetaGPT process found: PID={proc.info[0]}, Command={proc.info[2]}')

• linux / server:

journalctl -u metagpt | grep -i "error" -i "exception"

• generic web:

curl -I http://<target>/metagpt/actionoutput_str_to_mapping  # Check for unexpected responses or error messages

1. 2026-01-23Disclosure

   disclosure

2. 2026-01-23Patch

   patch

1. 予約済み2026-01-08
2. 公開日2026-01-23
3. EPSS 更新日2026-03-23

The primary mitigation for CVE-2026-0761 is to upgrade MetaGPT to version 0.8.2 or later, which includes the necessary fix. If immediate upgrading is not possible, consider implementing temporary workarounds. While a direct WAF rule is difficult to implement due to the code injection nature, restricting network access to the MetaGPT service and carefully reviewing any external data sources used by the application can reduce the attack surface. Monitor system logs for unusual Python process activity. After upgrading, confirm the fix by attempting to trigger the vulnerable function with a malicious payload; it should now be properly sanitized and fail to execute.