CVE-2026-5972

HIGH

A vulnerability has been found in FoundationAgents MetaGPT up to 0.8.1. This issue affects the function Terminal.run_command in the library metagpt/tools/libs/terminal.py. The manipulation leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The identifier of the patch is d04ffc8dc67903e8b327f78ec121df5e190ffc7b. Applying a patch is the recommended action to fix this issue.

CVSS v3.1 Score

7.3
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
LOW
Published: 4/9/2026Modified: 4/29/2026

Related Intelligence (0)

No articles currently reference this CVE.

References (6)

https://github.com/FoundationAgents/MetaGPT/Producthttps://github.com/FoundationAgents/MetaGPT/issues/1929Issue TrackingExploithttps://github.com/paipeline/MetaGPT/commit/d04ffc8dc67903e8b327f78ec121df5e190ffc7bPatchhttps://vuldb.com/submit/791745ExploitThird Party Advisoryhttps://vuldb.com/vuln/356526Third Party AdvisoryVDB Entryhttps://vuldb.com/vuln/356526/ctiPermissions RequiredVDB Entry