CVE-2026-5971

Katalog CVE

CVSS 9.8 · Critical EPSS 0,71%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada deepwisdom metagpt. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A flaw has been found in FoundationAgents MetaGPT up to 0.8.1. This vulnerability affects the function ActionNode.xml_fill of the file metagpt/actions/action_node.py of the component XML Handler. Executing a manipulation can lead to improper neutralization of directives in dynamically evaluated code. The attack may be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through a pull request but has not reacted yet.

Rincian

Terbit di NVD

9 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

EPSS (30 hari)

0,71% peluang dieksploitasi; lebih tinggi dari 52,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://vuldb.com/submit/791734 exploit · advisory pihak ketiga · vdb entry
• https://vuldb.com/vuln/356525 advisory pihak ketiga · vdb entry
• https://github.com/FoundationAgents/MetaGPT/issues/1928 exploit · issue tracking
• https://github.com/FoundationAgents/MetaGPT/ product
• https://github.com/FoundationAgents/MetaGPT/issues/1956 issue tracking
• https://vuldb.com/vuln/356525/cti permissions required · vdb entry