Security readout for executives and security teams
Plain-English summary
CVE-2026-0761 is a critical remote code execution flaw in Foundation Agents MetaGPT 0.8.1. An unauthenticated attacker could make the application run attacker-controlled Python code, potentially taking over the service account. Public sources provided do not state active exploitation or a confirmed patch.
Executive priority
Treat as urgent for any environment using MetaGPT 0.8.1, especially if reachable by untrusted users or systems. The business concern is full service compromise without authentication. If MetaGPT is not deployed, priority is limited to confirming absence through asset inventory.
Technical view
The flaw is in MetaGPT’s actionoutput_str_to_mapping function. User-supplied string input is not properly validated before being used to execute Python code, causing CWE-94 code injection. CVSS is 9.8: network exploitable, low complexity, no privileges, no user interaction, with high confidentiality, integrity, and availability impact.
Likely exposure
Organizations running Foundation Agents MetaGPT version 0.8.1 are the known exposed population. Risk is highest where MetaGPT services are reachable from untrusted networks or process untrusted agent outputs. The source bundle does not identify other affected versions or CPEs.
Exploitation context
The advisory says authentication is not required and exploitation can execute code as the service account. The CVE is not marked KEV in the provided data, and no cited source in the bundle states active exploitation in the wild.
Researcher notes
Evidence is strong for the vulnerability mechanics and severity based on the CVE and ZDI advisory reference. Evidence is incomplete on patch availability, affected version range beyond 0.8.1, and real-world exploitation. Avoid assuming broader product impact without vendor confirmation.
Mitigation direction
- Identify any Foundation Agents MetaGPT deployments and confirm version numbers.
- Prioritize MetaGPT 0.8.1 for urgent review and containment.
- Check Foundation Agents and ZDI guidance for fixed versions or official workarounds.
- Restrict network access to MetaGPT services until remediation is confirmed.
- Run the service with least-privilege accounts and isolate it from sensitive systems.
Validation and detection
- Confirm whether MetaGPT 0.8.1 is installed in production, development, or research environments.
- Review service exposure from internet, partner, and internal untrusted networks.
- Check application logs for unusual errors or unexpected Python execution behavior.
- Verify whether vendor remediation guidance has been applied once published or confirmed.
- Document compensating controls if no official fix is available.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-0761 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
9.8CriticalVector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- ZDI-26-027CVE reference · x_research-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Control of Generation of Code ('Code Injection')
Improper Control of Generation of Code ('Code Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.