A vulnerability has been found in FoundationAgents MetaGPT up to 0.8.1. This issue affects the function Terminal.run_command in the library metagpt/tools/libs/terminal.py. The manipulation leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The identifier of the patch is d04ffc8dc67903e8b327f78ec121df5e190ffc7b. Applying a patch is the recommended action to fix this issue.
References
| Link | Resource |
|---|---|
| https://github.com/FoundationAgents/MetaGPT/ | Product |
| https://github.com/FoundationAgents/MetaGPT/issues/1929 | Issue Tracking Exploit |
| https://github.com/paipeline/MetaGPT/commit/d04ffc8dc67903e8b327f78ec121df5e190ffc7b | Patch |
| https://vuldb.com/submit/791745 | Exploit Third Party Advisory VDB Entry |
| https://vuldb.com/vuln/356526 | Third Party Advisory VDB Entry |
| https://vuldb.com/vuln/356526/cti | Permissions Required VDB Entry |
Configurations
History
29 Apr 2026, 19:26
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Deepwisdom metagpt
Deepwisdom |
|
| CPE | cpe:2.3:a:deepwisdom:metagpt:*:*:*:*:*:*:*:* | |
| References | () https://github.com/FoundationAgents/MetaGPT/ - Product | |
| References | () https://github.com/FoundationAgents/MetaGPT/issues/1929 - Issue Tracking, Exploit | |
| References | () https://github.com/paipeline/MetaGPT/commit/d04ffc8dc67903e8b327f78ec121df5e190ffc7b - Patch | |
| References | () https://vuldb.com/submit/791745 - Exploit, Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/vuln/356526 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/vuln/356526/cti - Permissions Required, VDB Entry |
09 Apr 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-09 20:16
Updated : 2026-04-29 19:26
NVD link : CVE-2026-5972
Mitre link : CVE-2026-5972
CVE.ORG link : CVE-2026-5972
JSON object : View
Products Affected
deepwisdom
- metagpt