CVE-2026-4516 Details

A remote code execution vulnerability exists in Foundation Agents MetaGPT versions through 0.8.1, specifically within the DataInterpreter component. The issue arises from inadequate input validation on user-provided prompts in the file 'metagpt/actions/di/write_analysis_code.py'. This vulnerability allows for prompt injection, where an attacker can manipulate the language model into generating malicious Python code that is automatically executed in a Jupyter Notebook environment, without any security checks or sandbox restrictions.

Short-term mitigations include implementing strict input validation on the 'user_requirement' parameter to remove common prompt injection patterns, establishing a code review mechanism that requires human approval before executing generated code, and restricting the use of the Terminal tool in the MetaGPT framework. Long-term solutions involve creating a sandboxed execution environment for running code, validating the safety of code generated by the language model, and engineering prompts to prevent injection attacks.