p PatchFirst

CVE-2024-23750

CVE-2024-23750

This page contains facts from public vulnerability sources. Check the original advisory before updating.

MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code because RunCode.run_script() passes shell metacharacters to subprocess.Popen.

CVSS 8.8 · High · EPSS 1.0% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • metagpt PyPI

    Versions
    • 0.1
    • 0.3.0
    • 0.4.0
    • 0.5.0
    • 0.5.1
    • 0.5.2
    • 0.6.0
    • 0.6.1
    • 0.6.2
    • 0.6.3
    • 0.6.4
    • 0.6.5
    • 0.6.6
    Affected ranges
    • ECOSYSTEM: ≤ 0.6.6

    No fix published

  • metagpt PyPI

    Versions
    • 0.1
    • 0.3.0
    • 0.4.0
    • 0.5.0
    • 0.5.1
    • 0.5.2
    • 0.6.0
    • 0.6.1
    • 0.6.2
    • 0.6.3
    • 0.6.4
    Affected ranges
    • ECOSYSTEM: < 0.6.5

    Update to 0.6.5

Original sources

Check your server →