CVE-2026-5971: FoundationAgents MetaGPT XML action_node.py ActionNode.xml_fill eval injection
A flaw has been found in FoundationAgents MetaGPT up to 0.8.1. This vulnerability affects the function ActionNode.xmlfill of the file metagpt/actions/actionnode.py of the component XML Handler. Executing a manipulation can lead to improper neutralization of directives in dynamically evaluated code. The attack may be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through a pull request but has not reacted yet.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5971?
CVE-2026-5971 is considered to be of high severity due to its potential for eval injection, which can lead to remote execution of arbitrary code.
How do I fix CVE-2026-5971?
To fix CVE-2026-5971, upgrade the FoundationAgents MetaGPT package to version 0.8.2 or later.
What software is affected by CVE-2026-5971?
CVE-2026-5971 affects the FoundationAgents MetaGPT up to version 0.8.1.
What type of vulnerability is CVE-2026-5971?
CVE-2026-5971 is an eval injection vulnerability found in the ActionNode.xml_fill function.
Can CVE-2026-5971 lead to data compromise?
Yes, CVE-2026-5971 can potentially compromise data integrity and confidentiality by allowing attackers to execute arbitrary code.