Executive brief
MetaGPT, a multi-agent framework for software development, is vulnerable to a security flaw that allows attackers to force the server to make unauthorized network requests. By providing a malicious URL instead of an image, an attacker could potentially access internal company services, scan private networks, or steal cloud service credentials. This could lead to the exposure of sensitive internal data or unauthorized access to cloud infrastructure.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in MetaGPT versions up to and including 0.8.2. The vulnerability is located in the `decode_image` function within `metagpt/utils/common.py`, specifically due to insufficient validation of the `img_url_or_b64` argument. When a URL starting with 'http' is provided, the application uses the `requests.get()` method without verifying the destination. A remote attacker with low privileges can exploit this to perform non-blind SSRF, allowing them to access internal network resources (localhost, private IP ranges), fetch cloud metadata (AWS/Azure/GCP), or perform internal port scanning. While a pull request (#1941) has been proposed to implement URL validation and IP filtering, it has not been officially merged into a released version as of the advisory date.
Affected products
- FoundationAgents MetaGPT <= 0.8.2
Timeline
- 2026-02-11: other: Pull request with fix submitted by community member
- 2026-04-12: advisory: GitHub Advisory and NVD entry published