CVE-2026-5971 is a high severity flaw (CVSS 7.3) in MetaGPT up to 0.8.1. The XML handler function ActionNode.xml_fill neutralizes dynamically evaluated code poorly. The record lists no fixed version and says an exploit is public. Limit what can reach it and check the project for a patch.
What's affected
- Product: FoundationAgents MetaGPT (listed as
deepwisdom metagpt), versions up to and including 0.8.1. - Fixed version: none confirmed. The record says the project was told early and had not responded. Check the repository for a release newer than 0.8.1 before you rely on this.
- Affected code: the
ActionNode.xml_fillfunction inmetagpt/actions/action_node.py, part of the XML handler. - Weakness: CWE-94 (code injection) and CWE-95 (eval injection). CVSS 7.3 (high), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
How to check if you're exposed
MetaGPT is normally installed from PyPI. Find where it runs and which version.
pip show metagpt
pip list 2>/dev/null | grep -i metagpt
Search your container images, notebooks and CI jobs too, since agent frameworks tend to get installed in many places. The free scan at gold.safeguard.sh/scan reads a manifest in your browser and lists the version it finds.
What to do now
- Find every environment that installs MetaGPT and note the version. Anything at 0.8.1 or earlier is in range.
- Check the project's releases and the linked pull request for a fix, and read the change before you apply it. Do not assume a fix is merged.
- Do not expose the affected feature to untrusted users or to the network. Treat any input that reaches it as hostile.
- Run agent frameworks with the least access you can: a throwaway container, no cloud credentials in the environment, and restricted outbound network.
Why it matters
This one is about text produced by a model or a user being parsed and then evaluated as code. The linked issue describes arbitrary code execution through eval() in ActionNode. Agent frameworks often treat model output as trusted structure, and that trust is the weak point.
The class is CWE-95. The fix pattern is to parse structured data with a data parser and never evaluate it. The record says an exploit is public and the project had not reacted when it was written. It does not report exploitation, and the KEV flag is false. Both linked issues are discussions, not release notes, so check the repository for the current state.
Quick check
What triggers the flaw?
The record says a manipulation of ActionNode.xml_fill leads to improper neutralization of directives in dynamically evaluated code, and that the attack may be launched remotely.
Should I wait for a patch before acting?
No. Reduce exposure now: keep the framework off public networks and run it without credentials.
Sources
Last reviewed: 19 October 2026.
