ZeroDay Findings
Sign inSign up

Findings

CVE-2026-6110

A vulnerability was identified in FoundationAgents MetaGPT up to 0.8.1.

Published Apr 12, 2026 · updated Jun 17, 2026 · deepwisdom metagpt

A vulnerability was identified in FoundationAgents MetaGPT up to 0.8.1. This affects the function generate_thoughts of the file metagpt/strategy/tot.py of the component Tree-of-Thought Solver. The manipulation leads to code injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 12, 2026 · NIST NVD

    Detected

    A vulnerability was identified in FoundationAgents MetaGPT up to 0.8.1. This affects the function generate_thoughts of the file metagpt/strategy/tot.py of the component Tree-of-Thought Solver. The manipulation leads to code injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue r

  2. Jun 17, 2026 · NIST NVD

    Updated

    A vulnerability was identified in FoundationAgents MetaGPT up to 0.8.1. This affects the function generate_thoughts of the file metagpt/strategy/tot.py of the component Tree-of-Thought Solver. The manipulation leads to code injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue r

Affected

  • cpe deepwisdom/metagpt0.8.0
  • cpe deepwisdom/metagpt0.8.1

Sources

  • CVE.orgVulnerability recordCVE-2026-6110

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-6110

    A vulnerability was identified in FoundationAgents MetaGPT up to 0.8.1. This affects the function generate_thoughts of the file metagpt/strategy/tot.py of the component Tree-of-Thought Solver. The manipulation leads to code injection. It is possible to initiate the attack remotel

    nvd.nist.gov

References