CVE-2026-5973

HIGH

A vulnerability was found in FoundationAgents MetaGPT up to 0.8.1. Impacted is the function get_mime_type of the file metagpt/utils/common.py. The manipulation results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through a pull request but has not reacted yet.

CVSS v3.1 Score

7.3
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
LOW
Published: 4/9/2026Modified: 6/17/2026

Related Intelligence (0)

No articles currently reference this CVE.

References (6)

https://github.com/FoundationAgents/MetaGPT/Producthttps://github.com/FoundationAgents/MetaGPT/issues/1930ExploitIssue Trackinghttps://github.com/FoundationAgents/MetaGPT/pull/1983Issue TrackingPatchhttps://vuldb.com/submit/791755ExploitThird Party Advisoryhttps://vuldb.com/vuln/356527Third Party AdvisoryVDB Entryhttps://vuldb.com/vuln/356527/ctiPermissions Required