Is CVE-2026-6109 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6109 being exploited in the wild.

How severe is CVE-2026-6109?

Medium severity, with a CVSS score of 4.3, published 12 April 2026.

Which products and versions are affected?

metagpt (PyPI) ECOSYSTEM:introduced=0,last_affected=0.8.2.

Is there a fix for CVE-2026-6109?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-6109 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-6109?

Check whether you run Deepwisdom Metagpt or metagpt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6109: FoundationAgents MetaGPT RCE via CSRF in Mineflayer HTTP API

CVE-2026-6109 · Severity: medium · CVSS 4.3 · Published 2026-04-12

MetaGPT is an open-source multi-agent framework. A security flaw in its Minecraft environment component allows an attacker to execute malicious commands on a user's computer. This occurs if a user running the software visits a specially crafted website, potentially leading to full system takeover, data theft, or the installation of malware.

Technologies: Deepwisdom Metagpt, metagpt (PyPI). Vendors: Deepwisdom, PyPI.

Quick answers

Is CVE-2026-6109 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6109 being exploited in the wild.
How severe is CVE-2026-6109?: Medium severity, with a CVSS score of 4.3, published 12 April 2026.
Which products and versions are affected?: metagpt (PyPI) ECOSYSTEM:introduced=0,last_affected=0.8.2.
Is there a fix for CVE-2026-6109?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-6109 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-6109?: Check whether you run Deepwisdom Metagpt or metagpt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the Mineflayer HTTP API component of MetaGPT (specifically in `metagpt/environment/minecraft/mineflayer/index.js`) where the `/step` endpoint accepts arbitrary JavaScript code and executes it using `eval()`. The Express.js server lacks authentication, does not implement CORS protections, and binds to all network interfaces (0.0.0.0) by default. An attacker can exploit this by tricking a user into visiting a malicious webpage that sends a POST request to the local server. Because there are no cross-origin restrictions or authorization checks, the browser will execute the request, allowing the attacker to achieve Remote Code Execution (RCE) in the context of the user running MetaGPT. As of the advisory date, no official patch has been released.

Affected products

FoundationAgents MetaGPT <= 0.8.2

Identifiers

CVE-2026-6109
GHSA-w287-wwhf-95vv
PYSEC-2026-2643

Timeline

2026-04-12: advisory: GitHub Advisory published
2026-04-12: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.