Is CVE-2026-5971 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5971 being exploited in the wild.

How severe is CVE-2026-5971?

High severity, with a CVSS score of 7.3, published 9 April 2026.

Which products and versions are affected?

metagpt (PyPI) ECOSYSTEM:introduced=0,last_affected=0.8.1.

Is there a fix for CVE-2026-5971?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-5971 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-5971?

Check whether you run Deepwisdom Metagpt or metagpt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5971: FoundationAgents MetaGPT eval injection in ActionNode

CVE-2026-5971 · Severity: high · CVSS 7.3 · Published 2026-04-09

FoundationAgents MetaGPT is a multi-agent framework used to build AI-driven software applications. A security flaw in how it processes data from Large Language Models (LLMs) allows an attacker to execute malicious code on the server hosting the application. This could lead to a full system compromise, unauthorized data access, or service disruption.

Technologies: Deepwisdom Metagpt, metagpt (PyPI). Vendors: Deepwisdom, PyPI.

Quick answers

Is CVE-2026-5971 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5971 being exploited in the wild.
How severe is CVE-2026-5971?: High severity, with a CVSS score of 7.3, published 9 April 2026.
Which products and versions are affected?: metagpt (PyPI) ECOSYSTEM:introduced=0,last_affected=0.8.1.
Is there a fix for CVE-2026-5971?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-5971 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-5971?: Check whether you run Deepwisdom Metagpt or metagpt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Code Injection vulnerability (CWE-94/CWE-95) exists in MetaGPT's ActionNode.xml_fill method within metagpt/actions/action_node.py. The component uses the unsafe Python eval() function to parse strings extracted from LLM responses into list or dict objects. An attacker can exploit this via prompt injection or by compromising the LLM's output to include malicious Python directives within XML tags (e.g., <tag>__import__('os').system('id')</tag>). This allows for arbitrary code execution on the host system. As of the advisory date, no official patch has been released, though the issue has been reported to the maintainers.

Affected products

FoundationAgents MetaGPT <= 0.8.1

Identifiers

CVE-2026-5971
GHSA-3ghp-8r47-4gj4
PYSEC-2026-2638

Timeline

2026-02-04: other: Issue reported via GitHub issue #1928
2026-04-09: advisory: GitHub Advisory published
2026-04-09: disclosed: CVE-2026-5971 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.