CVE-2026-5970 is a high severity code injection flaw (CVSS 7.3) in MetaGPT up to 0.8.1, in the benchmark helper check_solution. The record names no fixed version and says the exploit is public. Isolate the feature, check the project for a patch, and avoid running untrusted input through it.
What's affected
- Product: FoundationAgents MetaGPT (listed as
deepwisdom metagpt), versions up to and including 0.8.1. - Fixed version: none confirmed. The record says the project was told early and had not responded. Check the repository for a release newer than 0.8.1 before you rely on this.
- Affected code: the
check_solutionfunction in theHumanEvalBenchmarkandMBPPBenchmarkcomponents. - Weakness: CWE-74 (injection) and CWE-94 (code injection). CVSS 7.3 (high), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
How to check if you're exposed
MetaGPT is normally installed from PyPI. Find where it runs and which version.
pip show metagpt
pip list 2>/dev/null | grep -i metagpt
Search your container images, notebooks and CI jobs too, since agent frameworks tend to get installed in many places. The free scan at gold.safeguard.sh/scan reads a manifest in your browser and lists the version it finds.
What to do now
- Find every environment that installs MetaGPT and note the version. Anything at 0.8.1 or earlier is in range.
- Check the project's releases and the linked pull request for a fix, and read the change before you apply it. Do not assume a fix is merged.
- Do not expose the affected feature to untrusted users or to the network. Treat any input that reaches it as hostile.
- Run agent frameworks with the least access you can: a throwaway container, no cloud credentials in the environment, and restricted outbound network.
Why it matters
Benchmark harnesses exist to run code and compare the result with an expected answer. That makes them a risky place to accept input you did not write. The record describes code injection reachable over the network, and the issue it links is titled as remote code execution through unsafe exec() in benchmark evaluation.
The weakness class is CWE-94: data ends up treated as code. The usual fix is to stop executing text from outside your control, or to run it in a sandbox with no host access. A linked pull request proposes isolating the namespace and subprocess. I could not confirm it was merged into a release. The record says the exploit is public. It does not say attacks are happening, and the KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is a fix available?
The record names none. A pull request is linked, but I could not confirm it was merged. Check the repository before you rely on it.
Is this exploited in the wild?
The record says an exploit is public. It is not in CISA's KEV list, and no source I read reports attacks.
Sources
Last reviewed: 19 October 2026.
