CVE-2026-6110 is a high severity code injection flaw (CVSS 7.3) in MetaGPT up to 0.8.1, in generate_thoughts of the Tree-of-Thought solver. The record names no fixed version and says the exploit is public. Keep the solver away from untrusted input and watch for a patch.
What's affected
- Product: FoundationAgents MetaGPT (listed as
deepwisdom metagpt), versions up to and including 0.8.1. - Fixed version: none confirmed. The record says the project was told early and had not responded. Check the repository for a release newer than 0.8.1 before you rely on this.
- Affected code: the
generate_thoughtsfunction inmetagpt/strategy/tot.py, part of the Tree-of-Thought solver. - Weakness: CWE-74 (injection) and CWE-94 (code injection). CVSS 7.3 (high), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
How to check if you're exposed
MetaGPT is normally installed from PyPI. Find where it runs and which version.
pip show metagpt
pip list 2>/dev/null | grep -i metagpt
Search your container images, notebooks and CI jobs too, since agent frameworks tend to get installed in many places. The free scan at gold.safeguard.sh/scan reads a manifest in your browser and lists the version it finds.
What to do now
- Find every environment that installs MetaGPT and note the version. Anything at 0.8.1 or earlier is in range.
- Check the project's releases and the linked pull request for a fix, and read the change before you apply it. Do not assume a fix is merged.
- Do not expose the affected feature to untrusted users or to the network. Treat any input that reaches it as hostile.
- Run agent frameworks with the least access you can: a throwaway container, no cloud credentials in the environment, and restricted outbound network.
Why it matters
The linked pull request is titled as replacing eval() with json.loads() in the Tree-of-Thought solver. That tells you the shape of the bug: text produced during a reasoning loop was evaluated as code instead of being parsed as data.
The weakness is CWE-94. A data parser reads values and nothing else, so it cannot be tricked into running anything. The record says the exploit is public and the project had not responded. It does not report attacks, and the KEV flag is false. I could not confirm the pull request was merged into a release.
Quick check
What is the simplest safe pattern?
Parse model output as data with a strict parser, and never pass it to eval() or exec().
Is it exploited in the wild?
The record says an exploit is public. It does not report attacks, and the KEV flag is false.
Sources
Last reviewed: 19 October 2026.
