id: PYSEC-2024-9
modified: 2024-01-22T07:20:28.329958Z
published: 2024-01-22T01:15:00Z
aliases:
- CVE-2024-23750
- GHSA-g7ph-8423-pf4j
details: MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code
  because RunCode.run_script() passes shell metacharacters to subprocess.Popen.
affected:
- package:
    ecosystem: PyPI
    name: metagpt
    purl: pkg:pypi/metagpt
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.6.5
  versions:
  - "0.1"
  - 0.3.0
  - 0.4.0
  - 0.5.0
  - 0.5.1
  - 0.5.2
  - 0.6.0
  - 0.6.1
  - 0.6.2
  - 0.6.3
  - 0.6.4
references:
- type: REPORT
  url: https://github.com/geekan/MetaGPT/issues/731
- type: ADVISORY
  url: https://github.com/advisories/GHSA-g7ph-8423-pf4j