Description

An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.rebuild_class_views() in metagpt/repo_parser.py.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-31T21:17:49.017Z",
  "pubdate": "2026-08-31T21:17:49.017Z",
  "executiveSummary": "An OS command injection vulnerability exists within the RepoParser.rebuild_class_views() function of MetaGPT version 0.8.1.\nThis vulnerability allows an unauthenticated or authenticated attacker to execute arbitrary operating system commands on the host machine by manipulating the path argument.\nThe flaw originates from improper sanitization of user-supplied input before passing it to system-level execution routines.\nSuccessful exploitation results in full remote code execution, granting the attacker the ability to access, modify, or delete sensitive data, install malicious software, or pivot within the host network.\nThe risk is critical, as MetaGPT is often integrated into automated workflows, potentially granting an attacker the permissions of the underlying service account.\nThe vulnerability does not explicitly require specific network exposure, as it depends on the ability to provide input to the affected function, which may be accessible through API endpoints, CLI arguments, or automated task triggers.",
  "technicalDetails": "The vulnerability resides in the metagpt/repo_parser.py file within the RepoParser.rebuild_class_views() function. The root cause is the insecure handling of the path argument, which is directly concatenated into a string executed as a shell command without adequate validation or shell escaping.\nWhen RepoParser.rebuild_class_views() is invoked, it accepts a path parameter meant to point to a repository directory. If this input is not validated against a strict allow-list or sanitized to remove shell metacharacters, an attacker can supply malicious payloads such as backticks, semicolons, pipes, or command substitution sequences.\nThe attack flow begins when an attacker identifies an entry point that calls RepoParser.rebuild_class_views() and allows user-controlled input to reach the path parameter. By injecting shell operators (e.g., ';', '&&', '||'), the attacker can terminate the intended command and append arbitrary system commands.\nFor example, if the function intended to run a command like 'ls [path]', an attacker providing '; cat /etc/passwd' results in the execution of 'ls; cat /etc/passwd'. The operating system interprets this as two distinct operations, executing the malicious command with the privileges of the MetaGPT process.\nBecause this execution occurs at the OS level, the payload executes with the same permissions as the MetaGPT process, potentially leading to unauthorized filesystem access, process monitoring, or reverse shell establishment.\nThe vulnerability affects MetaGPT version 0.8.1. There is no indication that authentication is a prerequisite if the entry point to the vulnerable function is exposed via a public-facing interface or an insecure automation pipeline. The lack of input sanitization means the vulnerability is inherent to the logic of how RepoParser.rebuild_class_views() processes system calls.\nPost-exploitation, an attacker can achieve full system compromise, escalate privileges if the service is running with high-level access, or establish persistence within the container or host environment."
}