CVE-2026-79408: n/a

This vulnerability in MetaGPT 0.8.1 involves an OS command injection through the path argument of the RepoParser.rebuild_class_views() function. An attacker can exploit this flaw to execute arbitrary commands on the underlying operating system without requiring privileges or user interaction. The flaw is categorized under CWE-78 (Improper Neutralization of Special Elements used in an OS Command). No patch or official remediation guidance has been provided yet, and there are no known exploits in the wild as of the published date.

Successful exploitation can lead to full system compromise, allowing an attacker to execute arbitrary commands with the privileges of the MetaGPT process. This can result in complete loss of confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid exposing the vulnerable function to untrusted input or restrict access to trusted users only. Monitor official MetaGPT channels for updates and patches.