PT-2026-32144 · Foundation Agents · Metagpt

Eric-D · Published 2026-04-12 · Updated 2026-04-12 · CVE-2026-6111

NVD

CVSS v2.0

6.5

Medium

AV:N/AC:L/Au:S/C:P/I:P/A:P

A security flaw has been discovered in FoundationAgents MetaGPT up to 0.8.1. This impacts the function decode image of the file metagpt/utils/common.py. The manipulation of the argument img url or b64 results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-6111

Affected Products

Metagpt

References · 7

• 🔥 https://github.com/FoundationAgents/MetaGPT/issues/1934 · Exploit
• https://github.com/FoundationAgents/MetaGPT/pull/1941 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-6111 · Security Note
• https://vuldb.com/vuln/356971 · Note
• https://vuldb.com/vuln/356971/cti · Note
• https://vuldb.com/submit/791762 · Note
• https://github.com/FoundationAgents/MetaGPT · Note