PT-2026-32144 · Foundation Agents · Metagpt

Eric-D · Published 2026-04-12 · Updated 2026-04-30 · CVE-2026-6111

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FoundationAgents MetaGPT versions up to 0.8.1

Description A security flaw exists in FoundationAgents MetaGPT versions up to 0.8.1. The decode image function within the metagpt/utils/common.py file is susceptible to server-side request forgery (SSRF) through manipulation of the img url or b64 argument. This allows for remote attacks. The exploit is publicly available. The project was notified of the issue but has not yet responded.

Recommendations Update FoundationAgents MetaGPT to a version newer than 0.8.1.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-6111

GHSA-R5V8-C28H-F8R8

Affected Products

Metagpt

References · 10

• 🔥 https://github.com/FoundationAgents/MetaGPT/issues/1934 · Exploit
• 🔥 https://vuldb.com/submit/791762 · Exploit
• https://github.com/FoundationAgents/MetaGPT/pull/1941 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-6111 · Security Note
• https://osv.dev/vulnerability/GHSA-r5v8-c28h-f8r8 · Vendor Advisory
• https://github.com/FoundationAgents/MetaGPT · Note
• https://twitter.com/CVEarity/status/2043314041041703336 · Twitter Post
• https://vuldb.com/vuln/356971 · Note
• https://vuldb.com/vuln/356971/cti · Note
• https://t.me/cveNotify/161555 · Telegram Post