CVE-2026-0761: MetaGPT Code Injection RCE Vulnerability

CVE-2026-0761 Overview

Foundation Agents MetaGPT contains a critical code injection vulnerability in the actionoutput_str_to_mapping function that allows remote attackers to execute arbitrary code on affected installations. This vulnerability exists due to the lack of proper validation of user-supplied strings before using them to execute Python code. Authentication is not required to exploit this vulnerability, making it particularly dangerous for internet-exposed deployments.

Critical Impact

Remote attackers can execute arbitrary code in the context of the service account without authentication, potentially leading to complete system compromise.

Affected Products

• Foundation Agents MetaGPT (all versions prior to patch)

Discovery Timeline

• 2026-01-23 - CVE-2026-0761 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2026-0761

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code), commonly known as Code Injection. The flaw exists within the actionoutput_str_to_mapping function of the MetaGPT framework. The function fails to properly sanitize user-supplied input before passing it to Python's code execution mechanisms.

The vulnerability is particularly severe because it can be exploited remotely over the network without requiring any authentication. An attacker who successfully exploits this vulnerability gains the ability to execute arbitrary Python code with the same privileges as the MetaGPT service account, which could lead to complete system compromise, data exfiltration, or lateral movement within the network.

Root Cause

The root cause of this vulnerability is improper input validation in the actionoutput_str_to_mapping function. The function accepts user-controlled string data and processes it in a way that allows Python code execution without adequate sanitization or sandboxing. This is a common vulnerability pattern in applications that dynamically evaluate or execute code based on external input.

Attack Vector

The vulnerability is exploitable over the network. An attacker can send specially crafted input to the MetaGPT application that, when processed by the actionoutput_str_to_mapping function, results in arbitrary Python code execution. No user interaction is required, and the attack does not require prior authentication to the system.

The exploitation mechanism involves injecting malicious Python code within the string parameter that gets passed to the vulnerable function. When the function processes this input without proper validation, the injected code is executed in the context of the running service.

For detailed technical information about this vulnerability, refer to the Zero Day Initiative Advisory ZDI-26-027.

Detection Methods for CVE-2026-0761

Indicators of Compromise

• Unusual process spawning from the MetaGPT service account
• Unexpected outbound network connections from the MetaGPT application
• Anomalous Python code execution patterns in application logs
• Suspicious strings containing Python code constructs in request payloads

Detection Strategies

• Monitor application logs for malformed or suspicious input to the actionoutput_str_to_mapping function
• Implement network-based detection rules for payloads containing Python code injection patterns
• Deploy endpoint detection to identify unauthorized code execution from the MetaGPT service
• Configure web application firewalls to detect and block code injection attempts

Monitoring Recommendations

• Enable verbose logging for the MetaGPT application to capture all input processing
• Monitor for unusual child processes spawned by the MetaGPT service
• Implement alerting for any privilege escalation attempts from the service account
• Review network traffic for data exfiltration patterns following potential exploitation

How to Mitigate CVE-2026-0761

Immediate Actions Required

• Restrict network access to MetaGPT installations to trusted sources only
• Implement input validation at the network perimeter using a web application firewall
• Run the MetaGPT service with minimal privileges using the principle of least privilege
• Consider temporarily disabling the affected functionality until a patch is available

Patch Information

Refer to the Zero Day Initiative Advisory ZDI-26-027 for the latest patch information and remediation guidance from the vendor. Apply security updates as soon as they become available.

Workarounds

• Implement strict network segmentation to isolate MetaGPT deployments from untrusted networks
• Deploy a web application firewall with rules to detect and block Python code injection patterns
• Restrict the service account permissions to minimize the impact of potential exploitation
• Monitor all input to the application and implement allowlisting for expected input formats

# Example: Restrict network access to MetaGPT service
# Add firewall rules to limit access to trusted IP ranges only
iptables -A INPUT -p tcp --dport <metagpt_port> -s <trusted_network> -j ACCEPT
iptables -A INPUT -p tcp --dport <metagpt_port> -j DROP