CVE-2026-79408: MetaGPT OS Command Injection Vulnerability

Summary

CVE-2026-79408 is an OS command injection vulnerability (CWE-78) in MetaGPT, the open-source multi-agent framework maintained by FoundationAgents that lets developers assemble teams of LLM-driven "agents" to automate software engineering tasks. In version 0.8.1, the path argument passed to RepoParser.rebuild_class_views() in metagpt/repo_parser.py is not properly sanitized before being used in a system command, allowing an attacker who controls that input to execute arbitrary commands on the host running MetaGPT.

Vulnerability Details

Part of a Broader Pattern in MetaGPT

CVE-2026-79408 is not an isolated finding. It follows closely on the heels of related command-injection issues disclosed around the same MetaGPT 0.8.1/0.8.2 timeframe, including a separate flaw in Terminal.run_command() and another reachable through the mermaid.path argument in check_cmd_exists. Taken together, these point to a systemic gap in how MetaGPT validates file-path and command-related input across the codebase, rather than a single one-off mistake.

That pattern matters because MetaGPT's core value proposition — autonomous agents that read repositories, write code, and execute commands to get work done — means the framework routinely handles untrusted or semi-trusted path input by design. Any code path that turns that input into a shell command is a high-value target.

Why This Matters for AI Agent Frameworks

MetaGPT sits in a growing category of agentic AI development tools that are increasingly being deployed with real filesystem and shell access, often exposed to inputs derived from LLM output, external repositories, or user-supplied project paths. Command-injection bugs in this class of software are especially dangerous because:

• Agent frameworks are frequently run with elevated local privileges to perform their automation tasks.
• Inputs can originate from multiple untrusted sources — cloned repositories, user prompts, or LLM-generated file paths — widening the attack surface beyond a single API parameter.
• The same framework may orchestrate several tools and subprocesses, so one injection point can cascade into broader compromise of the development environment.

This mirrors a wider 2026 trend of vulnerability researchers turning attention to AI orchestration and agent-building platforms — from Langflow's actively exploited remote-code-execution chain to command-injection issues across the MetaGPT codebase — as these tools move from research projects into production developer workflows.

Remediation

• Audit any code path that constructs commands from the path argument to RepoParser.rebuild_class_views(), or update to a patched MetaGPT release once available.
• Never pass untrusted or externally-sourced paths (cloned repository contents, user-submitted project directories) directly into MetaGPT's repository-parsing functions without independent validation.
• Run MetaGPT agents with least-privilege service accounts and container/sandbox isolation, given the framework's inherent need for filesystem and command execution access.
• Monitor FoundationAgents' MetaGPT repository for a security advisory and patched release addressing CVE-2026-79408 alongside its related command-injection siblings.

Sources

• OffSeq Threat Radar — CVE-2026-79408
• CodeAnt AI — OS Command Injection in MetaGPT Terminal.run_command (CVE-2026-5972)