Description
MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code because RunCode.run_script() passes shell metacharacters to subprocess.Popen.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | metagpt | <= 0.6.6 | — | GHSA-g7ph-8423-pf4j |
| PyPI | metagpt | < 0.6.5 | 0.6.5 | PYSEC-2024-9 |