—

PYSEC-2024-9

Quick fix

PYSEC-2024-9 — metagpt: upgrade to the fixed version with the command below.

pip install --upgrade 'metagpt>=0.6.5'

Details

MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code because RunCode.run_script() passes shell metacharacters to subprocess.Popen.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/metagpt

Introduced in: 0Fixed in: 0.6.5

Fixpip install --upgrade 'metagpt>=0.6.5'

References

https://github.com/geekan/MetaGPT/issues/731[REPORT]
https://github.com/advisories/GHSA-g7ph-8423-pf4j[ADVISORY]