Threat database

CVE-2026-19060 is a medium severity code injection vulnerability in FoundationAgents MetaGPT versions 0.8.0, 0.8.1, and 0.8.2. The vulnerability affects an unspecified function and requires local access to exploit. Public exploit code is available, but there is no vendor response or official patch at this time.

CVE-2026-0760 is a critical remote code execution vulnerability in Foundation Agents MetaGPT version 0.8.1. It arises from improper validation during deserialization of untrusted data in the deserialize_message function, allowing attackers to execute arbitrary code without authentication or user interaction. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS score of 9.8. Exploitation occurs remotely and requires no privileges, making it highly dangerous. Although no known exploits are currently in the wild, the flaw poses a significant risk to affected systems. European organizations using MetaGPT 0.8.