Executive brief
FoundationAgents MetaGPT is a multi-agent framework used to build AI-driven software applications. A security flaw in how it processes data from Large Language Models (LLMs) allows an attacker to execute malicious code on the server hosting the application. This could lead to a full system compromise, unauthorized data access, or service disruption.
Technical details
A Code Injection vulnerability (CWE-94/CWE-95) exists in MetaGPT's ActionNode.xml_fill method within metagpt/actions/action_node.py. The component uses the unsafe Python eval() function to parse strings extracted from LLM responses into list or dict objects. An attacker can exploit this via prompt injection or by compromising the LLM's output to include malicious Python directives within XML tags (e.g., <tag>__import__('os').system('id')</tag>). This allows for arbitrary code execution on the host system. As of the advisory date, no official patch has been released, though the issue has been reported to the maintainers.
Affected products
- FoundationAgents MetaGPT <= 0.8.1
Timeline
- 2026-02-04: other: Issue reported via GitHub issue #1928
- 2026-04-09: advisory: GitHub Advisory published
- 2026-04-09: disclosed: CVE-2026-5971 assigned