CVE-2026-5970

CVE-2026-5970 is a code injection vulnerability affecting FoundationAgents MetaGPT up to version 0.8.1, specifically in the check_solution function of the HumanEvalBenchmark and MBPPBenchmark components. The vulnerability allows attackers to manipulate the affected function to execute arbitrary code through injection attacks. The vulnerability carries a HIGH severity rating with a CVSS score of 7.3. It is remotely exploitable over the network without requiring authentication, user interaction, or special privileges, though it does require low attack complexity. The impact encompasses confidentiality, integrity, and availability, meaning successful exploitation could result in unauthorized information disclosure, system modification, and service disruption. The exploit has been publicly disclosed and is now available for active use by potential threat actors. However, the vulnerability currently shows no evidence of active exploitation in the wild, as it is not listed on the Known Exploited Vulnerabilities catalog. Notably, the project maintainers were informed of this issue early through a pull request submission but have not yet responded or released a patch, leaving affected users vulnerable to exploitation.