High severity7.3NVD Advisory· Published Apr 9, 2026· Updated Apr 29, 2026
CVE-2026-5972
CVE-2026-5972
Description
A vulnerability has been found in FoundationAgents MetaGPT up to 0.8.1. This issue affects the function Terminal.run_command in the library metagpt/tools/libs/terminal.py. The manipulation leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The identifier of the patch is d04ffc8dc67903e8b327f78ec121df5e190ffc7b. Applying a patch is the recommended action to fix this issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
metagptPyPI | < 0.8.2 | 0.8.2 |
Affected products
2Patches
Vulnerability mechanics
References
7- github.com/paipeline/MetaGPT/commit/d04ffc8dc67903e8b327f78ec121df5e190ffc7bnvdPatchWEB
- github.com/FoundationAgents/MetaGPT/issues/1929nvdIssue TrackingExploitWEB
- vuldb.com/submit/791745nvdExploitThird Party AdvisoryVDB EntryWEB
- github.com/advisories/GHSA-wp29-qmvj-frvpghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-5972ghsaADVISORY
- vuldb.com/vuln/356526nvdThird Party AdvisoryVDB EntryWEB
- vuldb.com/vuln/356526/ctinvdPermissions RequiredVDB EntryWEB
News mentions
0No linked articles in our index yet.