Two advisories landed against MetaGPT, one of the most cited multi-agent frameworks, with 70,148 GitHub stars. CVE-2026-79408 is OS command injection through the path argument of RepoParser.rebuild_class_views() in metagpt/repo_parser.py. CVE-2026-79407 is path traversal through the FILE_NAME value in metagpt/ext/spo/utils/load.py, allowing arbitrary file reads. Both are marked against version 0.8.1.
What "affects 0.8.1" implies, and why it is wrong here
A version range in an advisory normally means an upgrade exists. It does not. There is no patched version field in either record. The vulnerable code is still in the default branch: repo_parser.py still builds f"pyreverse {str(path)} -o dot" and passes it to subprocess.run(..., shell=True), and load.py still joins FILE_NAME onto a settings path with no normalisation. Version 0.8.2, the latest release, fixes neither — it was published in March 2025, and the repository's last push was 21 January 2026. It is not archived; it is simply not moving.
The scanner problem
Neither advisory carries a CVSS score, from the vendor or from NVD; severity reads unknown. Most dependency scanners are configured with a severity floor — high and above, or medium and above. An entry with no score does not clear a floor. In many pipelines these two will not raise anything at all, which is the practical difference between a disclosed vulnerability and a visible one.
Where the primitive sits
The command-injection path is inside repository parsing — the function an agent calls on a user-supplied codebase. That is exactly the surface an autonomous coding agent points at untrusted input by design.
The structural point
Advisories assume a maintainer on the other end. When a widely depended-on project stops accepting commits, disclosure produces a permanent public record of an unfixable flaw, and the burden moves entirely to whoever vendored it — most of whom will never see the alert.