CVE-2026-11455: MetaGPT Command Injection Vulnerability

CVE-2026-11455 Overview

CVE-2026-11455 is a command injection vulnerability in FoundationAgents MetaGPT through version 0.8.2. The flaw resides in the check_cmd_exists function inside metagpt/utils/common.py, where the mermaid.path configuration argument is passed to a shell context without proper sanitization. An authenticated remote attacker who controls the configuration value can inject operating system commands. Exploitation is rated as high complexity and requires low privileges, but a public exploit has been disclosed. The project maintainers were notified through a GitHub issue but had not responded at the time of disclosure.

Critical Impact
Authenticated attackers controlling the mermaid.path configuration can execute arbitrary shell commands in the context of the MetaGPT process, classified as improper neutralization of special elements ([CWE-74]).

Affected Products

FoundationAgents MetaGPT versions up to and including 0.8.2
metagpt/utils/common.py — check_cmd_exists function
Deployments consuming attacker-influenced mermaid.path configuration values

Discovery Timeline

2026-06-07 - CVE-2026-11455 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-11455

Vulnerability Analysis

MetaGPT is a multi-agent framework that orchestrates LLM-driven workflows, including diagram generation through Mermaid. The check_cmd_exists helper in metagpt/utils/common.py verifies that an external binary is available before invocation. The function constructs a shell command string from the configured mermaid.path value and executes it through the system shell rather than using an argument vector. Because the path value flows into the command string unsanitized, shell metacharacters such as ;, &&, |, and backticks are interpreted by the shell. An attacker who can influence the configuration — through a writable config file, environment variable, or an exposed configuration endpoint — can append arbitrary commands that execute alongside the intended lookup.

The published vulnerability disclosure rates the attack complexity as high. Exploitation requires the attacker to reach a code path that loads and uses the mermaid.path setting and to control its value. The impact maps to limited confidentiality, integrity, and availability loss on the host running MetaGPT.

Root Cause

The root cause is the use of a shell-interpreted execution primitive with concatenated untrusted input. The function does not validate that mermaid.path resolves to a legitimate file path, does not escape shell metacharacters, and does not switch to a safer non-shell exec style invocation with a list of arguments. This pattern matches [CWE-74]: improper neutralization of special elements in output used by a downstream component.

Attack Vector

The attack vector is network adjacent in the sense that the vulnerable code path runs server-side, but exploitation depends on the attacker influencing configuration. In multi-tenant or shared MetaGPT deployments, any user able to submit or override agent configuration parameters can inject a payload such as a path value containing a chained shell command. When check_cmd_exists next runs, the shell evaluates and executes the injected commands. See the Notion Analysis of Command Injection and GitHub Issue #2037 for technical details and a proof-of-concept payload.

Detection Methods for CVE-2026-11455

Indicators of Compromise

Unexpected child processes spawned by the MetaGPT Python interpreter, especially shells such as /bin/sh, bash, or cmd.exe invoked with -c flags containing operators like ;, &&, or |.
Modifications to MetaGPT configuration files where mermaid.path contains characters outside a typical file path, including spaces followed by shell operators.
Outbound network connections originating from the MetaGPT process to hosts not associated with LLM providers or registries.

Detection Strategies

Hunt for process trees where the MetaGPT Python process is the parent of sh -c invocations containing the substring mermaid together with command chaining tokens.
Inspect configuration files and environment variables loaded by MetaGPT for mermaid.path values that do not resolve to a valid binary on disk.
Apply rules referencing [CWE-74] command injection patterns in any code review or SAST pipeline covering MetaGPT integrations.

Monitoring Recommendations

Forward process creation telemetry from hosts running MetaGPT to a centralized analytics tier and alert on shell invocations parented by Python interpreters running MetaGPT modules.
Monitor file integrity for MetaGPT configuration paths and environment files so that unauthorized edits to mermaid.path raise an alert.
Track egress connections from MetaGPT workers and flag any destinations not on an allowlist of LLM and tooling endpoints.

How to Mitigate CVE-2026-11455

Immediate Actions Required

Audit all MetaGPT deployments for the presence of the check_cmd_exists function in metagpt/utils/common.py and confirm whether the mermaid.path configuration is reachable by untrusted users.
Set mermaid.path to a fixed, server-controlled value and remove the ability for end users or agents to override it through configuration files, environment variables, or API parameters.
Run MetaGPT under a least-privilege service account that cannot reach sensitive files, secrets, or internal services.

Patch Information

No vendor patch has been published at the time of disclosure. The maintainers were informed through GitHub Issue #2037 but have not responded. Track the GitHub MetaGPT Repository and VulDB CVE-2026-11455 entry for upstream fixes. Until a patched release ships, apply the workarounds below.

Workarounds

Pin mermaid.path to an absolute, hardcoded value in deployment automation and reject any runtime override that contains shell metacharacters such as ;, &, |, $, `, or newline characters.
Wrap or monkey-patch check_cmd_exists locally to use shutil.which or subprocess.run with a list argument and shell=False, eliminating shell interpretation of the path.
Restrict the OS user running MetaGPT with mandatory access controls (AppArmor, SELinux) or container seccomp profiles that block execution of unexpected binaries.

bash

# Configuration example: lock mermaid.path to a known-good binary
# and prevent shell metacharacters in deployment config
export METAGPT_MERMAID_PATH="/usr/local/bin/mmdc"
case "$METAGPT_MERMAID_PATH" in
  *[\;\&\|\$\`\"\'\\\ ]*)
    echo "Refusing to start: mermaid.path contains unsafe characters" >&2
    exit 1
    ;;
esac