CVE-2026-6110

CVE-2026-6110 is a code injection vulnerability affecting FoundationAgents MetaGPT versions up to 0.8.1, specifically in the generate_thoughts function of the Tree-of-Thought Solver component (metagpt/strategy/tot.py). The flaw permits remote code injection attacks without requiring authentication or user interaction. The vulnerability carries a CVSS score of 7.3 (HIGH) with a network-based attack vector and low complexity, meaning any unauthenticated attacker can exploit it remotely. The impact is moderate, potentially compromising confidentiality, integrity, and availability of affected systems. The EPSS score of 0.00068 indicates this is not yet among the most frequently targeted vulnerabilities in the wild. Exploitation status shows the vulnerability has public exploit code available and poses an active risk, though there is no current indication of widespread exploitation in the KEV catalog. The affected project was notified through an issue report but has not yet responded, suggesting remediation efforts may be delayed. Organizations running MetaGPT should prioritize updating to patched versions or implementing compensating controls.