CVE-2026-19059 FoundationAgents CVE debrief

Who should care

Users of FoundationAgents MetaGPT up to 0.8.2, particularly those responsible for vulnerability management, security teams, and operators of affected platforms, should review and verify their installations for potential vulnerabilities. They should also check for vendor remediation or patches and implement compensating controls for local attacks.

Technical summary

A path traversal vulnerability was found in FoundationAgents MetaGPT up to 0.8.2, affecting the read function in metagpt/tools/libs/editor.py. The attack requires local access, and users should review and verify their installations for potential vulnerabilities. The exploit has been publicly disclosed, and defenders should focus on local attack vectors and implement compensating controls. Details are limited, and users should check for vendor remediation or patches. The vulnerability allows for potential local attacks, and defenders should prioritize review of local access and path traversal risks.

Defensive priority

Low-priority defensive review recommended due to local attack requirements and low CVSS score.

Recommended defensive actions

• Review and verify the affected product and version
• Check for vendor remediation or patches
• Implement compensating controls for local attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence from Vuldb and NVD suggests a path traversal vulnerability in FoundationAgents MetaGPT up to 0.8.2. The vulnerability affects the read function in metagpt/tools/libs/editor.py, allowing for potential local attacks. Users should verify their installations and review compensating controls. Details are limited, and defenders should focus on local access and path traversal risks.

Official resources