high8.8
CVE-2024-23750
Code execution in metagpt
Impact
MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code because RunCode.run_script() passes shell metacharacters to subprocess.Popen.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | metagpt | >= 0, <= 0.6.6 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Deepwisdom | Metagpt | through 0.6.4 |