# CVE-2026-5972: FoundationAgents MetaGPT OS command injection in Terminal.run_command

Source: https://junglewise.ai/threats/cve-2026-5972-foundationagents-metagpt-os-command-injection-in-terminal-run  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-09. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-5972 · Severity: high · CVSS 7.3 · Published 2026-04-09

FoundationAgents MetaGPT, a framework for multi-agent AI systems, contains a vulnerability that allows for unauthorized command execution. The software's terminal tool fails to properly restrict the types of commands an AI agent can run, allowing a remote attacker to execute arbitrary system commands. This could lead to full system compromise, data theft, or the installation of malicious software on the host machine.

Technologies: [Deepwisdom Metagpt](https://junglewise.ai/threats/technologies/metagpt), [metagpt (PyPI)](https://junglewise.ai/threats/technologies/pypi-metagpt). Vendors: [Deepwisdom](https://junglewise.ai/threats/vendors/deepwisdom), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-5972 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5972 being exploited in the wild.

**How severe is CVE-2026-5972?** High severity, with a CVSS score of 7.3, published 9 April 2026.

**Which products and versions are affected?** metagpt (PyPI) ECOSYSTEM:introduced=0,fixed=0.8.2.

**Is there a fix for CVE-2026-5972?** Yes. metagpt (PyPI): upgrade to 0.8.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-5972 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-5972?** Check whether you run Deepwisdom Metagpt or metagpt (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- metagpt (PyPI): upgrade to 0.8.2 or later

  ```sh
  pip install "metagpt>=0.8.2"
  ```


## Technical details

A command injection vulnerability exists in MetaGPT's `Terminal.run_command` function within `metagpt/tools/libs/terminal.py`. The implementation relies on a weak blocklist that only filters specific strings like 'run dev' and 'serve ', failing to sanitize or block dangerous shell operators or system commands. Because the `Terminal` class is registered as an LLM-callable tool, an attacker can use prompt injection to influence the LLM into executing arbitrary bash commands via `self.process.stdin.write`. This allows for remote code execution (RCE) with the privileges of the application process. The issue is addressed in version 0.8.2.

## Affected products

- FoundationAgents MetaGPT <= 0.8.1

## Identifiers

- CVE-2026-5972
- GHSA-wp29-qmvj-frvp
- PYSEC-2026-2644

## Timeline

- 2026-02-04: other: Vulnerability reported via GitHub Issue #1929
- 2026-04-09: advisory: GitHub Advisory and NVD entry published
- 2026-04-09: patched: Patch commit d04ffc8dc67903e8b327f78ec121df5e190ffc7b identified

## References

- [https://github.com/FoundationAgents/MetaGPT/issues/1929](https://github.com/FoundationAgents/MetaGPT/issues/1929)
- [https://github.com/paipeline/MetaGPT/commit/d04ffc8dc67903e8b327f78ec121df5e190ffc7b](https://github.com/paipeline/MetaGPT/commit/d04ffc8dc67903e8b327f78ec121df5e190ffc7b)
- [https://github.com/FoundationAgents/MetaGPT](https://github.com/FoundationAgents/MetaGPT)
- [https://vuldb.com/submit/791745](https://vuldb.com/submit/791745)
- [https://vuldb.com/vuln/356526](https://vuldb.com/vuln/356526)

## Related threats

- [FoundationAgents MetaGPT unsafe deserialization in Message.check_instruct_content](https://junglewise.ai/threats/cve-2026-10566-foundationagents-metagpt-unsafe-deserialization-in-message-check)
- [FoundationAgents MetaGPT SSRF in decode_image](https://junglewise.ai/threats/cve-2026-6111-foundationagents-metagpt-ssrf-in-decode-image)
- [FoundationAgents MetaGPT code injection in Tree-of-Thought Solver](https://junglewise.ai/threats/cve-2026-6110-foundationagents-metagpt-code-injection-in-tree-of-thought-solver)
- [FoundationAgents MetaGPT RCE via CSRF in Mineflayer HTTP API](https://junglewise.ai/threats/cve-2026-6109-foundationagents-metagpt-rce-via-csrf-in-mineflayer-http-api)
- [FoundationAgents MetaGPT OS command injection in Bash tool](https://junglewise.ai/threats/cve-2026-5974-foundationagents-metagpt-os-command-injection-in-bash-tool)