Is CVE-2026-5972 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5972 being exploited in the wild.

How severe is CVE-2026-5972?

High severity, with a CVSS score of 7.3, published 9 April 2026.

Which products and versions are affected?

metagpt (PyPI) ECOSYSTEM:introduced=0,fixed=0.8.2.

Is there a fix for CVE-2026-5972?

Yes. metagpt (PyPI): upgrade to 0.8.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-5972 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-5972?

Check whether you run Deepwisdom Metagpt or metagpt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5972: FoundationAgents MetaGPT OS command injection in Terminal.run_command

CVE-2026-5972 · Severity: high · CVSS 7.3 · Published 2026-04-09

FoundationAgents MetaGPT, a framework for multi-agent AI systems, contains a vulnerability that allows for unauthorized command execution. The software's terminal tool fails to properly restrict the types of commands an AI agent can run, allowing a remote attacker to execute arbitrary system commands. This could lead to full system compromise, data theft, or the installation of malicious software on the host machine.

Technologies: Deepwisdom Metagpt, metagpt (PyPI). Vendors: Deepwisdom, PyPI.

Quick answers

Is CVE-2026-5972 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5972 being exploited in the wild.
How severe is CVE-2026-5972?: High severity, with a CVSS score of 7.3, published 9 April 2026.
Which products and versions are affected?: metagpt (PyPI) ECOSYSTEM:introduced=0,fixed=0.8.2.
Is there a fix for CVE-2026-5972?: Yes. metagpt (PyPI): upgrade to 0.8.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5972 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-5972?: Check whether you run Deepwisdom Metagpt or metagpt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

metagpt (PyPI): upgrade to 0.8.2 or later
```
pip install "metagpt>=0.8.2"
```

Technical details

A command injection vulnerability exists in MetaGPT's `Terminal.run_command` function within `metagpt/tools/libs/terminal.py`. The implementation relies on a weak blocklist that only filters specific strings like 'run dev' and 'serve ', failing to sanitize or block dangerous shell operators or system commands. Because the `Terminal` class is registered as an LLM-callable tool, an attacker can use prompt injection to influence the LLM into executing arbitrary bash commands via `self.process.stdin.write`. This allows for remote code execution (RCE) with the privileges of the application process. The issue is addressed in version 0.8.2.

Affected products

FoundationAgents MetaGPT <= 0.8.1

Identifiers

CVE-2026-5972
GHSA-wp29-qmvj-frvp
PYSEC-2026-2644

Timeline

2026-02-04: other: Vulnerability reported via GitHub Issue #1929
2026-04-09: advisory: GitHub Advisory and NVD entry published
2026-04-09: patched: Patch commit d04ffc8dc67903e8b327f78ec121df5e190ffc7b identified

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.