CVE-2026-11455: MetaGPT Command Injection in mermaid.path Parameter

Technical summary

CVE-2026-11455 is a command injection vulnerability affecting the check_cmd_exists function in metagpt/utils/common.py. The vulnerability stems from improper sanitization of the mermaid.path parameter, which is passed to system command execution without adequate validation. The attack surface is limited to authenticated users (requires login privileges), and the high complexity of exploitation reflects the need for precise argument manipulation. The vulnerability maps to CWE-74 (Improper Neutralization of Special Elements in Output) and CWE-77 (Improper Neutralization of Special Elements used in a Command).

Business impact

Teams using MetaGPT for agent-based workflows face potential code execution risks if an insider or compromised authenticated account is leveraged. Impact includes confidentiality, integrity, and availability compromise within the application sandbox and potentially broader system access depending on deployment context. Organizations should assess whether MetaGPT runs with elevated privileges or access to sensitive data pipelines. The public disclosure accelerates threat actor awareness, though the high complexity barrier somewhat limits opportunistic attacks.

Affected systems

FoundationAgents MetaGPT versions 0.8.2 and earlier are vulnerable. The flaw resides in the common.py utility file used by the framework's command execution pipeline. Any deployment or integration of MetaGPT below the patched version introduces risk. Open-source communities and enterprises embedding MetaGPT into AI workflows should immediately inventory their versions.

Exploitability

Exploitation requires authenticated access and substantial technical expertise to craft malicious mermaid.path arguments that bypass validation logic and inject executable payloads. The CVSS 3.1 score of 5.0 (Medium) reflects this complexity—while the vulnerability is real, it is not trivial to exploit in practice. Public disclosure has occurred, meaning attack methodology is accessible, but the high bar for execution should not create false confidence. Threat actors with development or DevOps knowledge can feasibly weaponize this in targeted scenarios.

Remediation

Upgrade MetaGPT to a patched version that addresses command injection in the mermaid.path parameter handling. Verify the exact patch version with the FoundationAgents project advisory. In the interim, restrict MetaGPT to low-privilege execution contexts, limit authenticated user access, and monitor command execution logs for suspicious mermaid-related invocations. Apply principle of least privilege to service accounts running MetaGPT.

Patch guidance

Check the FoundationAgents MetaGPT GitHub repository and official security advisories for a patched release version above 0.8.2. Apply patches to development, staging, and production environments systematically. Test compatibility with your AI agent workflows before full rollout. If you maintain a custom MetaGPT integration, review the metagpt/utils/common.py function locally and apply input validation fixes to mermaid.path prior to command execution.

Detection guidance

Monitor process and command execution logs for unusual mermaid.path parameter values, especially those containing shell metacharacters (|, ;, &, $, backticks, etc.). Track authentication events tied to MetaGPT service accounts and correlate with command execution timing. Implement application-level logging in check_cmd_exists to capture all mermaid.path inputs. Use endpoint detection and response (EDR) tools to flag command injection patterns. Search logs for error messages or warnings indicating failed path validation.

Why prioritize this

While the CVSS score is Medium (5.0) and exploitation requires authentication and high technical complexity, the public disclosure and the centrality of command execution to MetaGPT's utility layer warrant prompt attention. Organizations deploying MetaGPT in AI-driven automation workflows should prioritize patching to eliminate this vector, especially in environments where agent behavior may touch sensitive or production infrastructure. The window between disclosure and active patch deployment is a critical risk period.

Risk score, explained

The CVSS 3.1 score of 5.0 reflects a Medium severity rating driven by: (1) Network-accessible attack vector (AV:N), (2) High attack complexity requiring expertise (AC:H), (3) Low privilege requirement (PR:L—authentication needed), (4) No user interaction (UI:N), (5) Confidentiality, Integrity, and Availability impact limited to the vulnerable component scope (S:U, C:L, I:L, A:L). The score appropriately penalizes the difficulty of exploitation but credits the real impact potential once achieved. Organizations should not underweight this due to the 'Medium' label; authenticated code injection in framework utilities merits rapid remediation.

Frequently asked questions