CVE-2026-6110: Deepwisdom MetaGPT RCE Vulnerability

CVE-2026-6110 Overview

CVE-2026-6110 is a code injection vulnerability in FoundationAgents MetaGPT through version 0.8.1. The flaw resides in the generate_thoughts function within metagpt/strategy/tot.py, part of the Tree-of-Thought Solver component. Attackers can manipulate input passed to this function to inject and execute arbitrary code within the MetaGPT runtime. The issue is exploitable remotely over the network and requires no authentication. The vulnerability has been classified under CWE-74 (Improper Neutralization of Special Elements in Output). The exploit details are publicly disclosed, and the maintainers have not yet responded to the initial issue report.

Critical Impact
Remote attackers can execute arbitrary code through the Tree-of-Thought Solver without authentication, compromising the confidentiality, integrity, and availability of MetaGPT-based AI agent workloads.

Affected Products

FoundationAgents MetaGPT 0.8.0
FoundationAgents MetaGPT 0.8.1
Deployments using the Tree-of-Thought Solver (metagpt/strategy/tot.py)

Discovery Timeline

2026-04-12 - CVE-2026-6110 published to NVD
2026-04-30 - Last updated in NVD database

Technical Details for CVE-2026-6110

Vulnerability Analysis

MetaGPT is a multi-agent framework that orchestrates large language model (LLM) workflows. The Tree-of-Thought (ToT) Solver implemented in metagpt/strategy/tot.py decomposes complex tasks into intermediate reasoning steps. The generate_thoughts function processes content that flows from upstream prompt construction and model output, then passes that content into a code evaluation path. Because the function does not neutralize special language constructs in its input, attacker-controlled strings reach an interpreter and execute as code in the host Python process.

The vulnerability falls under CWE-74, the parent class for injection issues. Exploitation yields arbitrary code execution with the privileges of the MetaGPT worker process, which typically holds API keys, source repositories, and access to internal services.

Root Cause

The root cause is the absence of input sanitization between the LLM-driven reasoning pipeline and a dynamic code execution sink inside generate_thoughts. Any data path that influences the prompt or the parsed model response can deliver an injection payload. The maintainer pull request #1946 tracks the proposed remediation.

Attack Vector

An attacker reaches the vulnerable code by submitting crafted task descriptions, user prompts, or tool outputs that the agent forwards to the ToT Solver. In hosted MetaGPT deployments that expose chat or task-submission endpoints, a remote unauthenticated user can trigger execution. In agentic pipelines that consume third-party content (web pages, retrieved documents, downstream model output), indirect prompt injection can deliver the payload without direct user interaction.

Verified proof-of-concept code is not published in the realCodeExamples set for this advisory. Technical details are available in the MetaGPT issue tracker and the VulDB entry #356970.

Detection Methods for CVE-2026-6110

Indicators of Compromise

Unexpected child processes spawned by the Python interpreter hosting MetaGPT, particularly shells (sh, bash, cmd.exe) or network utilities (curl, wget).
Outbound network connections from MetaGPT worker hosts to previously unseen IPs or domains shortly after ToT Solver invocations.
New or modified files under the MetaGPT working directory or workspace that were not produced by legitimate task output.

Detection Strategies

Inspect application logs for ToT Solver invocations correlated with payload-like strings containing __import__, eval, exec, os.system, or backtick sequences.
Apply runtime monitoring to flag dynamic code evaluation paths reached from metagpt/strategy/tot.py frames.
Use endpoint detection telemetry to catch process lineage anomalies originating from the MetaGPT runtime user.

Monitoring Recommendations

Forward MetaGPT application logs and host process telemetry to a centralized analytics platform for correlation across agent invocations.
Establish a baseline of expected outbound destinations from MetaGPT workers and alert on deviation.
Track file integrity on the MetaGPT installation directory and any mounted credential stores.

How to Mitigate CVE-2026-6110

Immediate Actions Required

Restrict network access to MetaGPT instances so only trusted internal callers can submit tasks until a fixed release is available.
Disable the Tree-of-Thought Solver strategy in agent configurations where it is not required.
Run MetaGPT under a least-privilege service account isolated from production secrets and source repositories.
Review recent ToT Solver invocations and worker process activity for signs of exploitation.

Patch Information

A fix is proposed in pull request FoundationAgents/MetaGPT#1946. At the time of NVD publication, the project had not formally responded to the disclosure. Users should track the upstream MetaGPT repository for a tagged release that incorporates the patch and upgrade beyond version 0.8.1 once available.

Workarounds

Replace the Tree-of-Thought Solver with an alternative strategy that does not invoke dynamic code evaluation on model-derived content.
Sandbox the MetaGPT process using container isolation, seccomp profiles, or a dedicated virtual machine with no outbound internet access by default.
Apply a local patch that wraps generate_thoughts input through a strict allowlist or AST-based validator before any downstream evaluation.
Strip or escape Python language constructs (__, import, exec, eval, backticks) from user-supplied and tool-derived content prior to ToT processing.

bash

# Configuration example: run MetaGPT in an isolated, non-privileged container
docker run --rm \
  --user 10001:10001 \
  --read-only \
  --cap-drop=ALL \
  --security-opt=no-new-privileges \
  --network=metagpt-internal \
  -v /opt/metagpt/workspace:/workspace:rw \
  metagpt:0.8.1 \
  python -m metagpt.run --strategy=base   # avoid 'tot' until patched