CVE-2026-5974 is a high severity OS command injection (CVSS 7.3) in MetaGPT up to 0.8.1, in the Bash.run function of the terminal tools. The record names no fixed version and says the project had not reacted. Limit exposure, review the linked pull request, and update when a fix ships.
What's affected
- Product: FoundationAgents MetaGPT (listed as
deepwisdom metagpt), versions up to and including 0.8.1. - Fixed version: none confirmed. The record says the project was told early and had not responded. Check the repository for a release newer than 0.8.1 before you rely on this.
- Affected code: the
Bash.runfunction inmetagpt/tools/libs/terminal.py. - Weakness: CWE-77 (command injection) and CWE-78 (OS command injection). CVSS 7.3 (high), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
How to check if you're exposed
MetaGPT is normally installed from PyPI. Find where it runs and which version.
pip show metagpt
pip list 2>/dev/null | grep -i metagpt
Search your container images, notebooks and CI jobs too, since agent frameworks tend to get installed in many places. The free scan at gold.safeguard.sh/scan reads a manifest in your browser and lists the version it finds.
What to do now
- Find every environment that installs MetaGPT and note the version. Anything at 0.8.1 or earlier is in range.
- Check the project's releases and the linked pull request for a fix, and read the change before you apply it. Do not assume a fix is merged.
- Do not expose the affected feature to untrusted users or to the network. Treat any input that reaches it as hostile.
- Run agent frameworks with the least access you can: a throwaway container, no cloud credentials in the environment, and restricted outbound network.
Why it matters
This is the sibling of the Terminal.run_command problem in the same file. The linked pull request is titled as a security fix that prevents command injection in the Bash tool.
The weakness is CWE-78. It shows up whenever a framework builds a shell command from text it does not control. The record does not say an exploit is public for this entry, and it does not report attacks. The KEV flag is false. A pull request is linked, but I could not confirm it was merged into a release.
Quick check
Is this the same bug as CVE-2026-5972?
No. It is a separate record, with a different function, in the same terminal tools file.
Is it exploited in the wild?
The record does not say so, and CISA's KEV flag is false.
Sources
Last reviewed: 19 October 2026.
