Skip to main content

Metagpt EUVDEUVD-2026-21049

| CVE-2026-5972 MEDIUM
OS Command Injection (CWE-78)
2026-04-09 VulDB GHSA-wp29-qmvj-frvp
Command Injection Metagpt
5.5
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

6
CVSS changed
Apr 29, 2026 - 01:11 NVD
6.9 (MEDIUM) 5.5 (MEDIUM)
PoC Detected
Apr 09, 2026 - 20:16 vuln.today
Public exploit code
EUVD ID Assigned
Apr 09, 2026 - 19:45 euvd
EUVD-2026-21049
Analysis Generated
Apr 09, 2026 - 19:45 vuln.today
Patch released
Apr 09, 2026 - 19:45 nvd
Patch available
CVE Published
Apr 09, 2026 - 19:00 nvd
MEDIUM 6.9

DescriptionCVE.org

A vulnerability has been found in FoundationAgents MetaGPT up to 0.8.1. This issue affects the function Terminal.run_command in the library metagpt/tools/libs/terminal.py. The manipulation leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The identifier of the patch is d04ffc8dc67903e8b327f78ec121df5e190ffc7b. Applying a patch is the recommended action to fix this issue.

AnalysisAI

Remote code execution in FoundationAgents MetaGPT up to version 0.8.1 allows unauthenticated attackers to execute arbitrary OS commands via improper input validation in the Terminal.run_command function. The vulnerability exploits command injection in metagpt/tools/libs/terminal.py and has publicly available exploit code; patch commit d04ffc8dc67903e8b327f78ec121df5e190ffc7b is available from the vendor.

Technical ContextAI

MetaGPT is an AI-driven framework that processes agent instructions and automates tasks through tool execution. The vulnerability resides in the Terminal.run_command function within the terminal.py library module, which executes system commands without sufficient input sanitization. This is a classic OS command injection flaw (CWE-78) where user-controlled input is passed unsanitized to a system command execution primitive (likely subprocess or os.system in Python). The attack vector is network-accessible because MetaGPT likely exposes the Terminal tool through its agent interface or API, allowing remote command execution without authentication.

RemediationAI

Apply the vendor-released patch identified by commit d04ffc8dc67903e8b327f78ec121df5e190ffc7b from the MetaGPT repository. This commit addresses the input validation flaw in Terminal.run_command. Users should upgrade to a patched version released after this commit or manually apply the fix. Until patching is possible, disable or restrict access to the Terminal tool in MetaGPT configurations, and implement network-level controls to limit MetaGPT exposure. For detailed patch information and upgrade guidance, consult the FoundationAgents/MetaGPT GitHub issues (https://github.com/FoundationAgents/MetaGPT/issues/1929) and commit history (https://github.com/paipeline/MetaGPT/commit/d04ffc8dc67903e8b327f78ec121df5e190ffc7b).

More in Metagpt

View all
CVE-2024-23750 HIGH POC
8.8 Jan 22

MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code because RunCode.run_script() passes shell met
CVE-2026-0761 CRITICAL
9.8 Jan 23

MetaGPT has a code injection vulnerability in actionoutput_str_to_mapping (EPSS 2.6%) allowing remote attackers to execu
CVE-2026-0760 CRITICAL
9.8 Jan 23

MetaGPT by Foundation Agents has an insecure deserialization in deserialize_message (EPSS 1.7%) enabling remote code exe
CVE-2026-5973 MEDIUM POC
5.5 Apr 09

Remote command injection in FoundationAgents MetaGPT versions 0.8.0 and 0.8.1 via the get_mime_type function in metagpt/
CVE-2026-6110 MEDIUM POC
5.5 Apr 12

Code injection in FoundationAgents MetaGPT versions up to 0.8.1 allows unauthenticated remote attackers to execute arbit
CVE-2026-5971 MEDIUM POC
5.5 Apr 09

Remote code injection in FoundationAgents MetaGPT up to version 0.8.1 allows unauthenticated attackers to execute arbitr
CVE-2026-5970 MEDIUM POC
5.5 Apr 09

Code injection in FoundationAgents MetaGPT versions up to 0.8.1 allows unauthenticated remote attackers to execute arbit
CVE-2026-5974 MEDIUM
6.9 Apr 09

Remote command injection in FoundationAgents MetaGPT versions up to 0.8.1 allows unauthenticated network attackers to ex
CVE-2026-6111 LOW POC
2.1 Apr 12

Server-side request forgery (SSRF) in FoundationAgents MetaGPT up to version 0.8.1 allows authenticated remote attackers
CVE-2026-4516 LOW POC
2.1 Mar 21

A code injection vulnerability exists in Foundation Agents MetaGPT up to version 0.8.1, specifically in the DataInterpre
CVE-2026-4515 LOW POC
2.1 Mar 21

A code injection vulnerability exists in Foundation Agents MetaGPT versions up to 0.8.1 within the code_generate functio
CVE-2026-6109 LOW POC
2.1 Apr 12

Cross-site request forgery in FoundationAgents MetaGPT through version 0.8.1 allows unauthenticated remote attackers to

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2024-9474 MEDIUM POC
6.9

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Share

EUVD-2026-21049 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy