CVE-2026-79408

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-31 · updated 2026-09-01
Weakness: CWE-78

Description

An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.rebuild_class_views() in metagpt/repo_parser.py.

References

https://github.com/REYu6/Metagpt-vul/blob/main/CVE-1-MetaGPT-command-injection.md
https://github.com/REYu6/Metagpt-vul/blob/main/CVE-1-MetaGPT-command-injection.md

Get alerted when CVE-2026-79408 or the next vulnerability affects your stack