Executive brief
FoundationAgents MetaGPT, a framework for building AI-driven software agents, contains a security flaw in its terminal tool. This vulnerability allows an attacker to execute unauthorized operating system commands on the server or machine running the AI agent. If exploited, this could lead to a full system takeover, data theft, or disruption of operations.
Technical details
An OS command injection vulnerability exists in FoundationAgents MetaGPT versions up to and including 0.8.1. The flaw is located in the Bash.run function within the metagpt/tools/libs/terminal.py library, which fails to properly sanitize inputs before passing them to a system shell. A remote attacker can exploit this by providing malicious input—potentially via prompt injection if the tool is exposed to an LLM—to execute arbitrary commands on the host operating system. While a pull request (#1940) has been proposed to implement command validation and an allowlist, it has not yet been merged into the main project.
Affected products
- FoundationAgents MetaGPT <= 0.8.1
Timeline
- 2026-02-11: other: Pull request with security fix submitted by community member
- 2026-04-09: advisory: NVD and GitHub Advisory Database publication