CVE-2026-11455

A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. Affected by this issue is the function checkcmdexists of the file metagpt/utils/common.py. This manipulation of the argument mermaid.path causes command injection. The attack may be initiated remotely. A high degree of...

CVE-2026-11455 FoundationAgents MetaGPT common.py check_cmd_exists command injection

A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. Affected by this issue is the function checkcmdexists of the file metagpt/utils/common.py. This manipulation of the argument mermaid.path causes command injection. The attack may be initiated remotely. A high degree of...

CVE-2026-11455

A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. Affected by this issue is the function checkcmdexists of the file metagpt/utils/common.py. This manipulation of the argument mermaid.path causes command injection. The attack may be initiated remotely. A high degree of...

PT-2026-47177

Name of the Vulnerable Software and Affected Versions FoundationAgents MetaGPT versions prior to 0.8.3 Description Command injection is possible via the mermaid.path argument in the check cmd exists function located in the metagpt/utils/common.py file. This issue allows a remote attacker to execu...

Command Injection in command-exists

Versions of command-exists before 1.2.4 are vulnerable to command injection. This is exploitable if user input is provided to this module. Recommendation Update to version 1.2.4 or later...

@mean-expert/fireloop (>=1.0.0-alpha.8, <=1.0.0-beta.2.7), @shoutem/cli (>=0.10.5, <=0.13.5) +81 more potentially affected by unknown CVE via command-exists (>=1.0.2, <=1.2.2)

command-exists NPM version =1.0.2, =1.0.0-alpha.8, =0.10.5, =0.1.0, =5.0.11, =0.0.8, =0.2.0, =0.0.14, =1.0.0, =0.0.7, =0.0.4, =0.6.1, =0.0.13, =2.0.83, =13.0.22 and more Source cves: unknown CVE Source advisory: OSV:GHSA-CFF4-RRQ6-H78W...

GHSA-CFF4-RRQ6-H78W Command Injection in command-exists

Versions of command-exists before 1.2.4 are vulnerable to command injection. This is exploitable if user input is provided to this module. Recommendation Update to version 1.2.4 or later...

Command Injection

Overview Versions of command-exists before 1.2.4 are vulnerable to command injection. This is exploitable if user input is provided to this module. Recommendation Update to version 1.2.4 or later. References - HackerOne Report -...

Node.js third-party modules: `command-exists` concatenates unsanitized input into exec()/execSync() commands

I would like to report command injection in command-exists. It allows to inject and execute arbitrary shell commands while trying to determine if a crafted command exists. Module module name: command-exists version: 1.2.2 npm page: https://www.npmjs.com/package/command-exists Module Description...