CVE-2026-6111 - Vulnerability Analysis

Overview

FoundationAgents MetaGPT <= 0.8.1 contains a server-side request forgery caused by manipulation of the argument img_url_or_b64 in decode_image function, letting remote attackers make arbitrary server requests, exploit requires no special privileges.

Severity & Score

Impact

Remote attackers can make arbitrary requests from the server, potentially accessing internal resources or sensitive data.

Mitigation

Update to the latest version.

References

• https://vuldb.com/submit/791762
• https://vuldb.com/vuln/356971
• https://vuldb.com/vuln/356971/cti
• https://github.com/FoundationAgents/MetaGPT/
• https://github.com/FoundationAgents/MetaGPT/issues/1934
• https://github.com/FoundationAgents/MetaGPT/pull/1941

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner