Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

foundationagents/metagpt

              main @ 11cdf46
            

Fixes

CVEs

CRITICAL

Peak severity

23.5%

Coverage

Highlights

Denial of Service: 9 prior fixes. Scrutinize any change in this area.

metagpt/roles/role.py: most-fixed (4 issues). Treat as high-risk during review.

9 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Arbitrary Code Execution: The action deserialization logic historically resolved and loaded arbitrary module classes dynamically based on input dictionary keys without strict validation, exposing the system to instant remote code execution. This class of flaw is extremely dangerous in agent architectures handling untrusted payloads.

Insecure Deserialization: Deserializing inherited BaseModel classes within Message schemas allowed dynamic class loading via unvalidated dictionary structures, which can be manipulated to trigger arbitrary code instantiation.

Command Injection: Improper input handling when executing shell commands for helper operations (such as file mime-type detection) allowed shell metacharacter injection through unquoted filenames, documented in CVE-2026-5973.