CVE-2026-6109
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
In MetaGPT up to 0.8.1, the evaluateCode function in metagpt/environment/minecraft/mineflayer/index.js (Mineflayer HTTP API component) allows cross-site request forgery. The attack can be performed remotely and the exploit has been publicly disclosed.
Risk Assessment
A remote attacker can use the publicly known exploit to perform unauthorized actions in the context of an authenticated user. The project has not yet responded to the report, so a fix may not be available.
Recommendation
Restrict access to the Mineflayer HTTP API to trusted networks and implement CSRF protections (e.g., tokens). Track MetaGPT updates and apply the fix as soon as it becomes available.
Other vulnerabilities in MetaGPT
See all- CVE-2026-79408Critical
MetaGPT version 0.8.1 contains an OS command injection vulnerability. An attacker can execute arbitrary commands via the 'path' argument of RepoParser.rebuild_class_views() in metagpt/repo_parser.py.
- CVE-2026-79407High
A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the FILE_NAME value used by set_file_name() and load_meta_data() in metagpt/ext/spo/utils/load.py. The vulnerable code joins the attacker-controlled FILE_NAME value with the settings directory and opens the resulting path without validating that the resolved path remains within the intended directory.
- CVE-2026-19060Medium
A vulnerability was identified in FoundationAgents MetaGPT up to 0.8.2 affecting an unknown function, allowing code injection. The attack requires local access. The exploit is publicly available and might be used. The vendor did not respond.
- CVE-2026-19059Low
A path traversal vulnerability was found in FoundationAgents MetaGPT up to version 0.8.2, affecting the read function in metagpt/tools/libs/editor.py. The attack requires local access. The exploit has been publicly disclosed and may be used. The vendor did not respond to the disclosure.
- CVE-2026-19058Medium
A vulnerability was found in FoundationAgents MetaGPT up to 0.8.2 in the DataInterpreter function of the file metagpt/roles/di/data_interpreter.py, allowing code injection. The attack must be initiated locally. The exploit is public and could be used. The vendor did not respond.
- CVE-2026-11455Medium
A vulnerability has been determined in FoundationAgents MetaGPT up to version 0.8.2, allowing command injection in the check_cmd_exists function of metagpt/utils/common.py. The attack may be initiated remotely but requires high complexity. The exploit is publicly available, and the project has not responded.
- CVE-2026-10566Medium
In MetaGPT up to version 0.8.2, the function Message.check_instruct_content in metagpt/schema.py is vulnerable to deserialization via manipulation of the mapping argument. The attack requires local access.
- CVE-2026-6111Medium
A security flaw has been discovered in FoundationAgents MetaGPT up to 0.8.1. This impacts the decode_image function of the file metagpt/utils/common.py. Manipulation of the img_url_or_b64 argument results in server-side request forgery. The attack can be launched remotely and the exploit has been released to the public. The project was informed but has not responded.
Original NVD description (English source)
A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.1. The impacted element is the function evaluateCode of the file metagpt/environment/minecraft/mineflayer/index.js of the component Mineflayer HTTP API. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS