Is CVE-2026-6110 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6110 being exploited in the wild.

How severe is CVE-2026-6110?

High severity, with a CVSS score of 7.3, published 12 April 2026.

Which products and versions are affected?

metagpt (PyPI) ECOSYSTEM:introduced=0,last_affected=0.8.2.

Is there a fix for CVE-2026-6110?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-6110 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-6110?

Check whether you run metagpt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6110: FoundationAgents MetaGPT code injection in Tree-of-Thought Solver

CVE-2026-6110 · Severity: high · CVSS 7.3 · Published 2026-04-12

MetaGPT, an open-source multi-agent framework for AI development, contains a vulnerability in its Tree-of-Thought (ToT) solver component. This component is responsible for managing complex reasoning tasks by generating and evaluating multiple 'thoughts' or steps. An attacker can exploit this by providing malicious input that triggers the execution of arbitrary code on the system running the framework, potentially leading to full system compromise or unauthorized data access.

Technologies: metagpt (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-6110 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6110 being exploited in the wild.
How severe is CVE-2026-6110?: High severity, with a CVSS score of 7.3, published 12 April 2026.
Which products and versions are affected?: metagpt (PyPI) ECOSYSTEM:introduced=0,last_affected=0.8.2.
Is there a fix for CVE-2026-6110?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-6110 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-6110?: Check whether you run metagpt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A code injection vulnerability exists in MetaGPT versions up to and including 0.8.2 within the `generate_thoughts` function of `metagpt/strategy/tot.py`. The root cause is the use of Python's `eval()` function to parse responses from Large Language Models (LLMs) without prior sanitization or validation. An attacker can exploit this via prompt injection or by influencing the LLM's output to include malicious Python code, which is then executed by the framework. While a pull request (#1946) has been proposed to replace `eval()` with `json.loads()`, the advisory indicates the project had not officially responded or merged a fix at the time of publication. Exploitation can be achieved remotely if the application processes untrusted user input through the ToT solver.

Affected products

FoundationAgents MetaGPT <= 0.8.2

Identifiers

CVE-2026-6110
GHSA-xr7v-m9px-q4qj
PYSEC-2026-2645

Timeline

2026-02-20: other: Pull request #1946 submitted to fix the vulnerability
2026-04-12: advisory: GitHub Advisory published
2026-04-12: disclosed: CVE-2026-6110 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.