Package impact

PyPI / metagpt

CVE	Severity	CVSS	Risk	Published	Description
CVE-2026-6110	critical	9.8	9.8	2mo ago	MetaGPT has an eval injection in metagpt/strategy/tot.py
CVE-2026-5974	critical	9.8	9.8	2mo ago	FoundationAgents MetaGPT vulnerable to OS Command Injection in metagpt/tools/libs/terminal.py
CVE-2026-5973	critical	9.8	9.8	2mo ago	FoundationAgents MetaGPT vulnerable to OS Command Injection in metagpt/utils/common.py
CVE-2026-5972	critical	9.8	9.8	2mo ago	FoundationAgents MetaGPT vulnerable to os command injection via the Terminal.run_command
CVE-2026-5971	critical	9.8	9.8	2mo ago	A flaw has been found in FoundationAgents MetaGPT up to 0.8.1. This vulnerability affects the function ActionNode.xml_fill of the file metagpt/actions/action_node.py of the component XML Handler. Exe…
CVE-2026-5970	critical	9.8	9.8	2mo ago	MetaGPT has an Injection issue
CVE-2026-6109	high	8.8	8.8	2mo ago	MetaGPT has an eval injection via a cross-site request forgery attack
CVE-2026-6111	medium	6.5	6.5	2mo ago	MetaGPT affected by server-side request forgery in metagpt/utils/common.py
CVE-2024-23750	unknown	—	—	2y ago	MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code because RunCode.run_script() passes shell metacharacters to subprocess.Popen.