CVE-2026-4515: Deepwisdom MetaGPT RCE Vulnerability

CVE-2026-4515 Overview

CVE-2026-4515 is a code injection vulnerability in Foundation Agents MetaGPT through version 0.8.1. The flaw resides in the code_generate function within metagpt/ext/aflow/scripts/operator.py. Attackers can manipulate input to this function to inject and execute arbitrary code remotely. The issue is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

The exploit has been publicly disclosed, and the vendor, Deepwisdom, did not respond to disclosure attempts. No vendor patch is currently available.

Critical Impact
Authenticated remote attackers can inject code into the MetaGPT agent framework, enabling code execution within the application context.

Affected Products

Deepwisdom MetaGPT versions up to and including 0.8.1
Component: metagpt/ext/aflow/scripts/operator.py
Function: code_generate

Discovery Timeline

2026-03-21 - CVE-2026-4515 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-4515

Vulnerability Analysis

MetaGPT is a multi-agent framework that orchestrates large language model (LLM) agents to generate and execute code as part of automated software workflows. The code_generate function in the AFlow operator module accepts attacker-controlled input and passes it to a code execution path without adequate neutralization. This places the vulnerability in the code injection class tracked under [CWE-74].

Because MetaGPT agents are designed to produce and run code, the operator.py module performs dynamic evaluation of generated content. When an attacker supplies crafted instructions or prompt content, the framework treats injected payloads as legitimate generated code and executes them. The attack requires low-level privileges on the application but no user interaction.

Root Cause

The root cause is missing input neutralization in the code_generate operator. The function does not enforce sandboxing or filtering boundaries between agent-controlled data and the code executor. Untrusted content flows directly into a downstream component that interprets it as executable instructions.

Attack Vector

An attacker with low-privileged access to a MetaGPT-driven service sends crafted prompts or task definitions that reach the code_generate operator. The framework incorporates the payload into a generated routine and executes it within the agent runtime. A public proof-of-concept is available in the GitHub RCE Proof of Concept and the corresponding VulDB entry #352080. Refer to those references for exploitation details rather than synthetic reproductions.

Detection Methods for CVE-2026-4515

Indicators of Compromise

Unexpected child processes spawned by the Python interpreter hosting MetaGPT, particularly shells, network utilities, or package managers.
Outbound network connections from the MetaGPT process to attacker-controlled hosts not associated with configured LLM providers.
Anomalous writes by the MetaGPT process to script directories, cron paths, or ~/.ssh/ files on the host.
Log entries showing prompts or task definitions containing Python keywords such as exec, eval, __import__, or os.system.

Detection Strategies

Instrument the metagpt/ext/aflow/scripts/operator.py module to log raw inputs reaching code_generate for offline review.
Apply allow-listing on generated code by parsing the abstract syntax tree (AST) before execution and rejecting unexpected imports or built-in calls.
Correlate MetaGPT runtime telemetry with endpoint behavioral signals to surface process-tree deviations from expected agent workflows.

Monitoring Recommendations

Forward MetaGPT application logs and host process telemetry to a centralized analytics platform for correlation.
Monitor for outbound connections from agent hosts to non-approved domains and IP ranges.
Track filesystem changes under MetaGPT working directories and alert on writes outside expected workspace paths.

How to Mitigate CVE-2026-4515

Immediate Actions Required

Restrict access to any service that exposes MetaGPT to network input and require authentication plus authorization for all callers.
Run MetaGPT in an isolated sandbox or container with no outbound network access except to required LLM endpoints.
Drop privileges on the MetaGPT runtime user and remove write access to sensitive paths.
Disable or wrap the AFlow code_generate operator until a vendor fix is available.

Patch Information

Deepwisdom has not published a security patch as of the last NVD modification on 2026-04-29. The vendor did not respond to the disclosure. Track the project repository for updates beyond version 0.8.1 and review changes to metagpt/ext/aflow/scripts/operator.py before deployment.

Workarounds

Wrap calls to code_generate with an AST validator that rejects dangerous nodes such as Import, Call to eval/exec, and attribute access on os or subprocess.
Execute generated code only inside a minimal-privilege container or seccomp-restricted process.
Filter incoming task prompts to remove embedded code blocks or instructions that target the operator pipeline.
Apply network egress controls so the agent runtime can only reach approved LLM service endpoints.

bash

# Example container hardening for MetaGPT runtime
docker run --rm \
  --read-only \
  --cap-drop=ALL \
  --security-opt=no-new-privileges \
  --network=metagpt-egress-restricted \
  --user 10001:10001 \
  --tmpfs /tmp:rw,noexec,nosuid,size=128m \
  -v /opt/metagpt/workspace:/workspace:rw \
  metagpt:0.8.1