VulnerabilityAnalyzed
CVE-2026-5973
A vulnerability was found in FoundationAgents MetaGPT up to 0.8.1.
MEDIUM 5.5EPSS 2.51%
Does this matter?
Lower severity and a low EPSS score (2.51%). Track it; it rarely justifies an emergency change on its own.
Description
A vulnerability was found in FoundationAgents MetaGPT up to 0.8.1. Impacted is the function get_mime_type of the file metagpt/utils/common.py. The manipulation results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through a pull request but has not reacted yet.
- CVSS 4.0
- 5.5 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 2.51% probability · 84th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-77, CWE-78
- Affected
- deepwisdom/metagpt
- Source
- cna@vuldb.com
References
- https://github.com/FoundationAgents/MetaGPT/Product
- https://github.com/FoundationAgents/MetaGPT/issues/1930Exploit, Issue Tracking, Mitigation
- https://github.com/FoundationAgents/MetaGPT/pull/1983Issue Tracking, Patch
- https://vuldb.com/submit/791755Exploit, Third Party Advisory, VDB Entry
- https://vuldb.com/vuln/356527Third Party Advisory, VDB Entry
- https://vuldb.com/vuln/356527/ctiPermissions Required
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.