CVE-2026-10566

MediumCVSS 5.3/10Last modified Jul 22, 2026

Description

A weakness has been identified in FoundationAgents MetaGPT up to 0.8.2. This affects the function Message.check_instruct_content of the file metagpt/schema.py. Executing a manipulation of the argument mapping can lead to deserialization. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-20 CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Jun 2, 2026
Last modified: Jul 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1056606.9Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.CVE-2026-1056615.3Requesting `/{username}/-/repositories` for an individual user instead of an organization made the organization home handler dereference a n CVE-2026-1056645.3The endpoint exposes an observable response discrepancy when processing ID values. A request submitted with a nonexistent ID returns a disti CVE-2026-1056677.5In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remo CVE-2026-1056687.1Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account CVE-2026-1056696.7Argument injection in Ivanti Sentry before version 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with admin privileges to CVE-2026-105673.5A security vulnerability has been detected in 1Panel-dev CordysCRM up to 1.4.1. This impacts the function Save of the file src/main/java/cn/CVE-2026-1056716.9The login flow in Zenitel Connect before 1.11.0 returns different error responses depending on whether a submitted username exists, which al CVE-2026-1056728.7TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the HTTPS JSON API dispatcher on TCP port 443. An a CVE-2026-1056737.1An unauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in the RTSP streaming service on TCP port 554 when the Camera Ac CVE-2026-1056748.7TP-Link Tapo C325WB V2 generates the pre-shared key used by its local media streaming service with a time-seeded pseudo-random number genera CVE-2026-1056757.5Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to disco