Description

A vulnerability was found in FoundationAgents MetaGPT up to 0.8.2. The impacted element is the function DataInterpreter of the file metagpt/roles/di/data_interpreter.py. The manipulation results in code injection. The attack must be initiated from a local position. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-06T22:16:52.730Z",
  "pubdate": "2026-08-06T22:16:52.730Z",
  "executiveSummary": "A code injection vulnerability has been identified in FoundationAgents MetaGPT versions up to 0.8.2. The security flaw resides within the DataInterpreter function located in the metagpt/roles/di/data_interpreter.py file. Successful exploitation of this vulnerability allows a local attacker to execute arbitrary code within the context of the running application.\nThe vulnerability presents significant risk implications regarding system integrity and confidentiality, as it enables unauthorized execution of injected instructions. The attack vector requires local positioning to initiate the exploit, meaning an adversary must already have local access or the ability to manipulate inputs processed locally by the vulnerable component. Publicly available exploit material increases the urgency for remediation.\nDespite early contact by researchers, the vendor has failed to provide a response or official patch, leaving deployments exposed to potential abuse unless compensating controls are implemented.",
  "technicalDetails": "The vulnerability stems from insecure handling of input within the DataInterpreter function implemented in metagpt/roles/di/data_interpreter.py. Specifically, the component fails to properly sanitize or validate data before passing it to execution sinks, resulting in a code injection vulnerability.\nThe affected product is FoundationAgents MetaGPT, specifically targeting versions up to 0.8.2. Exploitation of this flaw requires local positioning, implying that network exposure is not strictly necessary for the initial attack vector, but rather local access or local process interaction.\nThe attack flow proceeds as follows: First, the local adversary crafts a malicious payload designed to escape input constraints or abuse evaluation mechanisms present in the DataInterpreter function. Second, the adversary introduces this payload locally, targeting the execution flow handled by metagpt/roles/di/data_interpreter.py. Third, the application processes the untrusted input without adequate sanitization, leading to the direct evaluation or execution of the injected instructions.\nUpon successful exploitation, the payload executes with the privileges of the user running the MetaGPT instance. This post-exploitation impact can range from unauthorized data access to complete compromise of the local environment depending on the execution context and underlying system permissions."
}