CVE-2026-5974
HIGHFoundationAgents MetaGPT terminal.py Bash.run os command injection
Title source: cnaDescription
A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.1. The affected element is the function Bash.run in the library metagpt/tools/libs/terminal.py. This manipulation causes os command injection. The attack is possible to be carried out remotely. The project was informed of the problem early through a pull request but has not reacted yet.
References (6)
Scores
CVSS v3
7.3
EPSS
0.0041
EPSS Percentile
61.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-77
CWE-78
Status
published
Products (4)
deepwisdom/metagpt
< 0.8.1
FoundationAgents/MetaGPT
0.8.0
FoundationAgents/MetaGPT
0.8.1
pypi/metagpt
0PyPI
Published
Apr 09, 2026
Tracked Since
Apr 10, 2026