Is there a public PoC exploit available for CVE-2026-5971?

Yes, a public proof-of-concept exploit is available for CVE-2026-5971. Prioritise patching immediately. EPSS: 0.1%.

Metagpt CVE-2026-5971

Q: What is the CVSS score of CVE-2026-5971?

CVE-2026-5971 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-21004 MEDIUM

Eval Injection (CWE-95)

2026-04-09 VulDB

GHSA-3ghp-8r47-4gj4

Information Disclosure Code Injection Metagpt

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 09, 2026 - 18:17 vuln.today

Public exploit code

EUVD ID Assigned

Apr 09, 2026 - 18:15 euvd

EUVD-2026-21004

Analysis Generated

Apr 09, 2026 - 18:15 vuln.today

CVE Published

Apr 09, 2026 - 18:00 nvd

MEDIUM 6.9

DescriptionCVE.org

A flaw has been found in FoundationAgents MetaGPT up to 0.8.1. This vulnerability affects the function ActionNode.xml_fill of the file metagpt/actions/action_node.py of the component XML Handler. Executing a manipulation can lead to improper neutralization of directives in dynamically evaluated code. The attack may be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through a pull request but has not reacted yet.

AnalysisAI

Remote code injection in FoundationAgents MetaGPT up to version 0.8.1 allows unauthenticated attackers to execute arbitrary code via improper neutralization of directives in the ActionNode.xml_fill XML handler function. The vulnerability has publicly available exploit code and affects the dynamic code evaluation mechanism in metagpt/actions/action_node.py, enabling attackers to manipulate XML input for code injection with low complexity and no authentication required.

Technical ContextAI

The vulnerability stems from CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code), which occurs when untrusted input is used in dynamic code evaluation without proper sanitization. In MetaGPT, the ActionNode.xml_fill function in the XML Handler component processes XML data that is subsequently evaluated as code. The affected CPE (cpe:2.3:a:foundationagents:metagpt:*:*:*:*:*:*:*:*) indicates all versions up to 0.8.1 are vulnerable. The XML parsing mechanism fails to neutralize malicious directives embedded in XML attributes or content, allowing attackers to inject code that will be executed within the application's Python interpreter context.

RemediationAI

No vendor-released patch identified at time of analysis. The project was notified early through GitHub pull request but has not yet implemented or released a fix. Users should monitor the official MetaGPT repository (https://github.com/FoundationAgents/MetaGPT) for security updates. As an interim mitigation, implement strict input validation and sanitization for all XML data fed to the ActionNode.xml_fill function, restrict network access to MetaGPT instances if operationally feasible, and consider running MetaGPT in isolated or sandboxed environments to limit the impact of potential code injection. Review GitHub issues #1928 and #1956 for community-proposed mitigations until an official patch is released.