CVE-2026-5974

CriticalCVSS 9.8/10Last modified Oct 26, 2026

Description

A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.1. The affected element is the function Bash.run in the library metagpt/tools/libs/terminal.py. This manipulation causes os command injection. The attack is possible to be carried out remotely. The project was informed of the problem early through a pull request but has not reacted yet.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77 CWE-78

Affected software

Vendor	Product	Versions
FoundationAgents	MetaGPT	0.8.0; 0.8.1

References

https://github.com/FoundationAgents/MetaGPT/Product
https://github.com/FoundationAgents/MetaGPT/issues/1931Exploit, Issue Tracking
https://github.com/FoundationAgents/MetaGPT/pull/1940Issue Tracking, Patch
https://vuldb.com/submit/791758Exploit, Third Party Advisory, VDB Entry
https://vuldb.com/vuln/356528Third Party Advisory, VDB Entry
https://vuldb.com/vuln/356528/ctiPermissions Required

Timeline

Published: Apr 9, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-59759.8A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. The impacted element is the function setDmzCfg of the file /cgi-bin CVE-2026-59769.8A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setStorageCfg of the file /cgi-bin/c CVE-2026-597627.5When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. CVE-2026-597634.3Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads CVE-2026-597648.6ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in WebUI. If this vulnerability is explo CVE-2026-597657.5SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata CVE-2026-597664.3Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated wi CVE-2026-597699.1FA-50 all versions contain hard-coded credentials. An attacker, who knows the credentials and has access to the vessel's internal network, CVE-2026-59779.8A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the function setWiFiBasicCfg of the file /cgi-bin/cste CVE-2026-597716.7Improper validation of array index in the MigTD's virtio-serial driver for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hy CVE-2026-597749.8Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server CVE-2026-597767.0Missing Cryptographic Step (CWE-325) vulnerability exists in certain FeliCa IC chips shipped in or before 2017. If the vulnerability is expl