GitHub Advisoryadvisory · PyPI

GHSA-qw5f-qpq5-ppfg FoundationAgents MetaGPT vulnerable to OS Command Injection in metagpt/utils/common.py

MEDIUM Published 2026-04-09 Modified 2026-04-10 Official page ↗
Aliases
CVE-2026-5973
Ecosystem
PyPI
Packages
metagpt
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-77
Reviewed
2026-04-10

Affected packages

• PyPI metagpt: <= 0.8.1 (no fix yet)

Description

A vulnerability was found in FoundationAgents MetaGPT up to 0.8.1. Impacted is the function get_mime_type of the file metagpt/utils/common.py. The manipulation results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through a pull request but has not reacted yet.

Related

Alias · CVE (1)

  • CVE-2026-5973 A vulnerability was found in FoundationAgents MetaGPT up to 0.8.1. vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References