High severity7.3NVD Advisory· Published Apr 9, 2026· Updated Apr 29, 2026
CVE-2026-5974
CVE-2026-5974
Description
A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.1. The affected element is the function Bash.run in the library metagpt/tools/libs/terminal.py. This manipulation causes os command injection. The attack is possible to be carried out remotely. The project was informed of the problem early through a pull request but has not reacted yet.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
metagptPyPI | <= 0.8.1 | — |
Affected products
2Patches
Vulnerability mechanics
References
7- github.com/FoundationAgents/MetaGPT/pull/1940nvdIssue TrackingPatchWEB
- github.com/FoundationAgents/MetaGPT/issues/1931nvdIssue TrackingExploitWEB
- vuldb.com/submit/791758nvdExploitThird Party AdvisoryVDB EntryWEB
- github.com/advisories/GHSA-fcc8-4q7h-wvwcghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-5974ghsaADVISORY
- vuldb.com/vuln/356528nvdThird Party AdvisoryVDB EntryWEB
- vuldb.com/vuln/356528/ctinvdPermissions RequiredWEB
News mentions
0No linked articles in our index yet.