CVE-2026-6109

OVERVIEW CVE-2026-6109 affects FoundationAgents MetaGPT versions up to 0.8.1, specifically targeting the evaluateCode function in the Mineflayer HTTP API component (metagpt/environment/minecraft/mineflayer/index.js). This vulnerability enables attackers to perform cross-site request forgery (CSRF) attacks against vulnerable installations. SEVERITY The vulnerability carries a CVSS score of 4.3 (Medium severity) with a network-based attack vector requiring low complexity and no privileges, though user interaction is required. The primary impact is integrity compromise with no confidentiality or availability effects. The FAUCET Risk Score of 38.0/100 indicates moderate concern, while the extremely low EPSS score of 0.000060 suggests limited real-world exploitation likelihood currently. EXPLOITATION STATUS The vulnerability has been publicly disclosed and proof-of-concept exploit code is available. However, there is no active exploitation reported, as indicated by its absence from the Known Exploited Vulnerabilities (KEV) catalog and inactive status on threat tracking lists. The development team was notified early but has not yet responded to the disclosure, leaving patches unavailable at this time.