13 matches found
EUVD-2024-0100
Malicious code in bioql PyPI...
CVE-2024-23750
MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code because RunCode.runscript passes shell metacharacters to subprocess.Popen...
Arbitrary Code Execution
metagpt is vulnerable to Arbitrary Code Execution. The vulnerability is due to the 'RunCode.runscript function passing shell metacharacters to subprocess.Popen caused by improper prompt santization. A user with the QaEngineer role can execute arbitrary code...
GHSA-G7PH-8423-PF4J Code execution in metagpt
MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code because RunCode.runscript passes shell metacharacters to subprocess.Popen...
CVE-2024-23750
MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code because RunCode.runscript passes shell metacharacters to subprocess.Popen...
PYSEC-2024-9
MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code because RunCode.runscript passes shell metacharacters to subprocess.Popen...
Design/Logic Flaw
MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code because RunCode.runscript passes shell metacharacters to subprocess.Popen...
PYSEC-2024-9
MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code because RunCode.runscript passes shell metacharacters to subprocess.Popen...
CVE-2024-23750
MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code because RunCode.runscript passes shell metacharacters to subprocess.Popen...
CVE-2024-23750
Summary: CVE-2024-23750 affects MetaGPT (0.6.4 and earlier). The root cause is in RunCode.run_script(), which passes shell metacharacters to subprocess.Popen, enabling arbitrary code execution by the QaEngineer role. Impact: full code execution with high severity (CVSS 3.1 base score 8.8) as indi...
CVE-2024-23750
MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code because RunCode.runscript passes shell metacharacters to subprocess.Popen...
CVE-2024-23750: Improper Control of Generation of Code
MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code because RunCode.runscript passes shell metacharacters to subprocess.Popen...