CVE-2026-5972
FoundationAgents MetaGPT terminal.py Terminal.run_command os command injection
CVSS Score
7.3
EPSS Score
0.8%
EPSS Percentile
75th
A vulnerability has been found in FoundationAgents MetaGPT up to 0.8.1. This issue affects the function Terminal.run_command in the library metagpt/tools/libs/terminal.py. The manipulation leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The identifier of the patch is d04ffc8dc67903e8b327f78ec121df5e190ffc7b. Applying a patch is the recommended action to fix this issue.
| CWE | CWE-78 CWE-77 |
| Vendor | foundationagents |
| Product | metagpt |
| Published | Apr 9, 2026 |
| Last Updated | Apr 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for foundationagents metagpt
Be the first to know when new high vulnerabilities affecting foundationagents metagpt are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
FoundationAgents / MetaGPT
0.8.0 0.8.1
References
vuldb.com: https://vuldb.com/vuln/356526 vuldb.com: https://vuldb.com/vuln/356526/cti vuldb.com: https://vuldb.com/submit/791745 github.com: https://github.com/FoundationAgents/MetaGPT/issues/1929 github.com: https://github.com/paipeline/MetaGPT/commit/d04ffc8dc67903e8b327f78ec121df5e190ffc7b github.com: https://github.com/FoundationAgents/MetaGPT/
Credits
🔍 Eric-c (VulDB User)