CVE-2026-5973: FoundationAgents MetaGPT common.py get_mime_type os command injection

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-09 · updated 2026-10-26
Weakness: CWE-77

Description

A vulnerability was found in FoundationAgents MetaGPT up to 0.8.1. Impacted is the function get_mime_type of the file metagpt/utils/common.py. The manipulation results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through a pull request but has not reacted yet.

Affected products

FoundationAgents MetaGPT: through 0.8.1

References

https://github.com/FoundationAgents/MetaGPT/
https://github.com/FoundationAgents/MetaGPT/issues/1930
https://github.com/FoundationAgents/MetaGPT/pull/1983
https://vuldb.com/submit/791755
https://vuldb.com/vuln/356527
https://vuldb.com/vuln/356527/cti

Get alerted when CVE-2026-5973 or the next vulnerability affects your stack