CVE-2026-5974: FoundationAgents MetaGPT terminal.py Bash.run OS command injection
A command injection flaw (CWE-77) in the Bash.run function of the terminal.py module of FoundationAgents MetaGPT, reported for versions up to and including 0.8.1. NVD rates it critical with a base score of 9.8, and the record describes it as remotely triggerable. The record states the project was alerted through a pull request but has not yet responded, and no confirmed exploitation appears in the sources consulted.
Overview
MetaGPT is an open-source multi-agent framework from FoundationAgents. According to the record, the Bash.run function in metagpt/tools/libs/terminal.py is vulnerable to OS command injection (CWE-77) and can be triggered remotely. The described range is up to and including 0.8.1.
Impact
- The NVD CVSS vector rates confidentiality, integrity and availability impact as high.
- Command injection generally allows an attacker to make the affected process run operating system commands it was not meant to run. The concrete impact in any given deployment is unknown from the record.
Affected products and versions
- The record lists Deepwisdom Metagpt with versions up to and including 0.8.1.
- The record lists FoundationAgents MetaGPT with versions 0.8.0 and 0.8.1.
- Check the project page to confirm which version you run.
Exploitation status
- The record marks this CVE as not listed in the CISA KEV catalog, so no active exploitation is confirmed by KEV.
- No confirmed exploitation in the wild appears in the sources consulted.
- The record carries an SSVC exploitation value of poc and an EPSS probability of 0.03456, which indicate exploit development signals rather than observed attacks.
- Some external references are tagged as exploit-related. Their contents were not used for this analysis.
Remediation and mitigation
- The record links a pull request (1940) as a patch. Whether it is merged or included in a release is unknown from the record.
- No fixed version is confirmed. A missing fixed version does not mean no fix exists, so track the upstream repository.
- Inventory all MetaGPT deployments and identify those at or below 0.8.1.
- Limit exposure of agent tooling to untrusted input and run the service with least privilege, ideally inside an isolated container or sandbox.
- Restrict network reachability of services that expose agent functionality.
Detection guidance
- Monitor for unexpected child processes spawned by the MetaGPT Python process, especially shell interpreters.
- Review logs of agent tool invocations for unusual or unexpected command strings.
- Alert on outbound connections initiated by the agent host that do not match normal operations.
Limitations of the available information
- The record does not confirm a fixed release or whether the pull request was merged.
- The record does not describe the exact input conditions or the full technical mechanism.
- CVSS scores differ between providers (NVD, VulDB), and the record does not state which is authoritative for every organization.
- Affected version ranges are taken from the record and may not reflect every distribution or fork.
Frequently asked questions
Which MetaGPT versions are affected by CVE-2026-5974?
The record describes versions up to and including 0.8.1, and lists FoundationAgents MetaGPT versions 0.8.0 and 0.8.1 as affected. Check your installed version against these entries.
Is this vulnerability being actively exploited?
The record does not list this CVE in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted. The record shows an SSVC value of poc, which signals that proof-of-concept activity may exist.
Is there a fix available?
The record links pull request 1940 as a patch, but it does not confirm that the change was merged or released. Track the upstream project and apply a fixed release once it is published.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.