Executive brief
MetaGPT is an open-source multi-agent framework. A security flaw in its Minecraft environment component allows an attacker to execute malicious commands on a user's computer. This occurs if a user running the software visits a specially crafted website, potentially leading to full system takeover, data theft, or the installation of malware.
Technical details
A vulnerability exists in the Mineflayer HTTP API component of MetaGPT (specifically in `metagpt/environment/minecraft/mineflayer/index.js`) where the `/step` endpoint accepts arbitrary JavaScript code and executes it using `eval()`. The Express.js server lacks authentication, does not implement CORS protections, and binds to all network interfaces (0.0.0.0) by default. An attacker can exploit this by tricking a user into visiting a malicious webpage that sends a POST request to the local server. Because there are no cross-origin restrictions or authorization checks, the browser will execute the request, allowing the attacker to achieve Remote Code Execution (RCE) in the context of the user running MetaGPT. As of the advisory date, no official patch has been released.
Affected products
- FoundationAgents MetaGPT <= 0.8.2
Timeline
- 2026-04-12: advisory: GitHub Advisory published
- 2026-04-12: disclosed: NVD publication date