GHSA-fcc8-4q7h-wvwc

FoundationAgents MetaGPT vulnerable to OS Command Injection in metagpt/tools/libs/terminal.py

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-5974

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	metagpt	<= 0.8.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.1. The affected element is the function Bash.run in the library metagpt/tools/libs/terminal.py. This manipulation causes os command injection. The attack is possible to be carried out remotely. The project was informed of the problem early through a pull request but has not reacted yet.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-5974 advisory
https://github.com/FoundationAgents/MetaGPT/issues/1931 web
https://github.com/FoundationAgents/MetaGPT/pull/1940 web
https://github.com/FoundationAgents/MetaGPT package
https://vuldb.com/submit/791758 web
https://vuldb.com/vuln/356528 web
https://vuldb.com/vuln/356528/cti web