Attack Chain

1. An attacker identifies a MetaGPT instance running version 0.8.1 or earlier.
2. The attacker crafts a malicious input string containing OS commands.
3. This malicious string is passed to the Bash.run function in metagpt/tools/libs/terminal.py.
4. Due to insufficient input validation, the injected commands are not properly neutralized.
5. The Bash.run function executes the injected OS commands using the underlying operating system’s shell.
6. The attacker gains the ability to execute arbitrary code on the server.
7. The attacker could then install malware, create new user accounts, or exfiltrate sensitive data.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary operating system commands on the server hosting the vulnerable MetaGPT instance. This could lead to complete system compromise, including data theft, malware installation, and denial-of-service attacks. Due to the nature of command injection, the impact is highly dependent on the privileges of the user account running the MetaGPT application.

Recommendation

• Apply input validation and sanitization to the Bash.run function in the metagpt/tools/libs/terminal.py library to prevent command injection (CVE-2026-5974).
• Monitor process creations for unusual commands executed by the MetaGPT application (see Sigma rule “Detect Suspicious MetaGPT Bash.run Execution”).
• Deploy a web application firewall (WAF) to filter out potentially malicious payloads being sent to the MetaGPT application.