CVE-2026-5972

HIGH

FoundationAgents MetaGPT terminal.py Terminal.run_command os command injection

Title source: cna
STIX 2.1

Description

A vulnerability has been found in FoundationAgents MetaGPT up to 0.8.1. This issue affects the function Terminal.run_command in the library metagpt/tools/libs/terminal.py. The manipulation leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The identifier of the patch is d04ffc8dc67903e8b327f78ec121df5e190ffc7b. Applying a patch is the recommended action to fix this issue.

References (6)

Core 6
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-356526 | FoundationAgents MetaGPT terminal.py Terminal.run_command os command injection
https://vuldb.com/vuln/356526
Signature, Permissions Required signature permissions-required
VDB-356526 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/356526/cti
Third Party Advisory third-party-advisory
Submit #791745 | FoundationAgents MetaGPT 0.8.1 OS Command Injection (CWE-78)
https://vuldb.com/submit/791745

Scores

CVSS v3 7.3
EPSS 0.0233
EPSS Percentile 81.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-77 CWE-78
Status published
Products (4)
deepwisdom/metagpt < 0.8.1
FoundationAgents/MetaGPT 0.8.0
FoundationAgents/MetaGPT 0.8.1
pypi/metagpt 0 - 0.8.2PyPI
Published Apr 09, 2026
Tracked Since Apr 10, 2026