CVE-2026-5972 is a high severity OS command injection (CVSS 7.3) in MetaGPT up to 0.8.1, in Terminal.run_command. The record names a patch identifier, d04ffc8dc67903e8b327f78ec121df5e190ffc7b, and says applying a patch is the recommended action. Confirm the change reached a release you can install, and limit exposure meanwhile.
What's affected
- Product: FoundationAgents MetaGPT (listed as
deepwisdom metagpt), versions up to and including 0.8.1. - Fixed version: none confirmed. The record says the project was told early and had not responded. Check the repository for a release newer than 0.8.1 before you rely on this.
- Affected code: the
Terminal.run_commandfunction inmetagpt/tools/libs/terminal.py. - Weakness: CWE-77 (command injection) and CWE-78 (OS command injection). CVSS 7.3 (high), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. - Patch: the record names commit
d04ffc8dc67903e8b327f78ec121df5e190ffc7b, hosted in a fork of the repository. Confirm it is in an upstream release before you count on it.
How to check if you're exposed
MetaGPT is normally installed from PyPI. Find where it runs and which version.
pip show metagpt
pip list 2>/dev/null | grep -i metagpt
Search your container images, notebooks and CI jobs too, since agent frameworks tend to get installed in many places. The free scan at gold.safeguard.sh/scan reads a manifest in your browser and lists the version it finds.
What to do now
- Find every environment that installs MetaGPT and note the version. Anything at 0.8.1 or earlier is in range.
- Review the commit the record names and check whether a release containing it exists. Read the change before you apply it.
- Keep the terminal tools away from untrusted input. Treat any text that reaches them as hostile.
- Run agent frameworks with the least access you can: a throwaway container, no cloud credentials in the environment, and restricted outbound network.
Why it matters
A terminal tool inside an agent framework is built to run commands. The danger comes when the text of a command, or part of it, comes from a source nobody vetted. The record classifies this as OS command injection, reachable remotely.
The weakness is CWE-78. Safer designs pass arguments as a list instead of building a shell string, allow only a fixed set of commands, and run the whole tool in a sandbox. The record says the exploit is public and that applying the named patch is the recommended action. It does not report attacks in the wild, and the KEV flag is false.
Quick check
Is there a patch?
The record names commit d04ffc8dc67903e8b327f78ec121df5e190ffc7b and recommends applying it. The commit is in a fork, so check whether upstream released it.
Can I mitigate without patching?
Keep the terminal tool away from untrusted input, and run it in a container with no secrets.
Sources
Last reviewed: 19 October 2026.
