CVE-2024-23750: PYSEC-2024-9 - MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code because RunCode.run_script() passes shell metacharacters to subpr

CVE-2024-23750 · Severity: low · CVSS 3.1 · Published 2024-01-22

Technologies: metagpt (PyPI). Vendors: PyPI.

Executive brief

MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code because RunCode.run_script() passes shell metacharacters to subprocess.Popen.

Affected products

PyPI metagpt

Related threats

PYSEC-2026-2640 - MetaGPT has an Injection issue
FoundationAgents MetaGPT unsafe deserialization in Message.check_instruct_content
FoundationAgents MetaGPT SSRF in decode_image
FoundationAgents MetaGPT code injection in Tree-of-Thought Solver
FoundationAgents MetaGPT RCE via CSRF in Mineflayer HTTP API