CVE-2026-5974

EUVD-2026-21072
A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.1. The affected element is the function Bash.run in the library metagpt/tools/libs/terminal.py. This manipulation causes os command injection. The attack is possible to be carried out remotely. The project was informed of the problem early through a pull request but has not reacted yet.
Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.3 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 64%
Affected Products (NVD)
VendorProductVersion
deepwisdommetagpt
𝑥
≤ 0.8.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/FoundationAgents/MetaGPT/
https://github.com/FoundationAgents/MetaGPT/issues/1931
https://github.com/FoundationAgents/MetaGPT/pull/1940
https://vuldb.com/submit/791758
https://vuldb.com/vuln/356528
https://vuldb.com/vuln/356528/cti