| Titel | FoundationAgents MetaGPT 0.8.1 Code Injection (CWE-94) |
|---|
| Beschreibung | # Technical Details
A Code Injection vulnerability exists in the `run_code` function in `metagpt/ext/aflow/scripts/operator.py` of MetaGPT.
The application fails to properly sandbox Python code execution. It uses an incomplete blocklist mechanism that checks for simple strings like `import os`. This is easily bypassed by using dynamic import methods like `__import__` or `importlib`.
# Vulnerable Code
File: metagpt/ext/aflow/scripts/operator.py
Method: run_code()
Why: The security check only looks for string literals "import {lib}" or "from {lib}", failing to block `__import__('os')` and allowing arbitrary execution via `exec()`.
# Reproduction
1. Create a malicious payload that avoids the literal string "import os", such as:
`def solve(): __import__('os').system('touch /tmp/bypass_proof')`
2. Pass this payload to the `run_code` function in `operator.py`.
3. The blocklist is bypassed and `exec()` executes the payload.
4. Verify `/tmp/bypass_proof` exists on the host.
# Impact
- Remote Code Execution: An attacker influencing LLM outputs can execute arbitrary OS commands, leading to complete control over the host running the MetaGPT instance. |
|---|
| Quelle | ⚠️ https://github.com/FoundationAgents/MetaGPT/issues/1926 |
|---|
| Benutzer | Eric-y (UID 95889) |
|---|
| Einreichung | 28.03.2026 03:17 (vor 6 Monaten) |
|---|
| Moderieren | 09.04.2026 14:04 (12 days later) |
|---|
| Status | Duplikat |
|---|
| VulDB Eintrag | 352080 [Foundation Agents MetaGPT bis 0.8.1 operator.py code_generate erweiterte Rechte] |
|---|
| Punkte | 0 |
|---|