PyPI/metagpt CVE-2026-5972: high 7.3, EPSS 3.49%

FoundationAgents MetaGPT vulnerable to os command injection via the Terminal.run_command

Action: Upgrade metagpt to 0.8.2 or later.

pip install metagpt==0.8.2

Affected

Fixed versions

Sources

• osv: PYSEC-2026-2644
• https://nvd.nist.gov/vuln/detail/CVE-2026-5972
• https://github.com/FoundationAgents/MetaGPT/issues/1929
• https://github.com/paipeline/MetaGPT/commit/d04ffc8dc67903e8b327f78ec121df5e190ffc7b
• https://github.com/FoundationAgents/MetaGPT
• https://vuldb.com/submit/791745
• https://vuldb.com/vuln/356526
• https://vuldb.com/vuln/356526/cti
• https://pypi.org/project/metagpt
• https://github.com/advisories/GHSA-wp29-qmvj-frvp

CVE-2026-5972 · published 2026-07-13T14:36:50.669901Z · modified 2026-07-13T16:31:50.023187071Z · JSON