High severity7.3NVD Advisory· Published Apr 9, 2026· Updated Apr 29, 2026
CVE-2026-5971
CVE-2026-5971
Description
A flaw has been found in FoundationAgents MetaGPT up to 0.8.1. This vulnerability affects the function ActionNode.xml_fill of the file metagpt/actions/action_node.py of the component XML Handler. Executing a manipulation can lead to improper neutralization of directives in dynamically evaluated code. The attack may be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through a pull request but has not reacted yet.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
metagptPyPI | <= 0.8.1 | — |
Affected products
2Patches
Vulnerability mechanics
References
7- github.com/FoundationAgents/MetaGPT/issues/1928nvdIssue TrackingExploitWEB
- vuldb.com/submit/791734nvdExploitThird Party AdvisoryVDB EntryWEB
- github.com/advisories/GHSA-3ghp-8r47-4gj4ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-5971ghsaADVISORY
- vuldb.com/vuln/356525nvdThird Party AdvisoryVDB EntryWEB
- github.com/FoundationAgents/MetaGPT/issues/1956nvdIssue TrackingWEB
- vuldb.com/vuln/356525/ctinvdPermissions RequiredVDB EntryWEB
News mentions
0No linked articles in our index yet.