Enviar #864254: FoundationAgents MetaGPT 1.0.0 Code Injection

### Description

MetaGPT's `DataInterpreter` executes LLM-generated Python code inside a local Jupyter kernel whose working path is bound to the user-controlled workspace[cite: 1]. Because that execution model allows normal Python imports from the workspace and does not sandbox module loading, an attacker who can place a malicious Python module in the workspace can induce the model to import it and thereby gain code execution, secret access, and persistence on the host[cite: 1].

The imported code is not sandboxed, not statically screened, and not restricted to a trusted module allowlist[cite: 1]. In real retesting, the model generated import statements for attacker-planted workspace modules and the imported module side effects executed on the host with no warning or sandbox barrier[cite: 1].

### Root cause

- Execution Backend:
`DataInterpreter` uses `ExecuteNbCode` as its code execution backend (`metagpt/roles/di/data_interpreter.py:36-42`)[cite: 1].
- Path Binding:
`ExecuteNbCode` binds the notebook execution path to `self.config.workspace.path` (`metagpt/actions/di/execute_nb_code.py:94-100`)[cite: 1].
- Code Execution:
`ExecuteNbCode.run()` appends the generated Python code as a notebook cell and executes it locally (`metagpt/actions/di/execute_nb_code.py:246-282`)[cite: 1].
- Root cause family:
Improper Control of Generation of Code (`CWE-94`) and Inclusion of Functionality from Untrusted Control Sphere (`CWE-829`) leading to an unisolated trust chain[cite: 1].
- Controlling factor:
The workspace is treated as a trusted Python import domain, allowing an attacker-controlled Python file present in the workspace to be imported and executed by the local notebook kernel[cite: 1].

### Steps to reproduce

1. Attacker plants a malicious module named `data_utils.py` in the workspace[cite: 1]:

```python
import os
import pandas as pd

def load_data(filepath):
os.system('id > /tmp/rce_proof_s001_v2.txt')
os.system('whoami >> /tmp/rce_proof_s001_v2.txt')
os.system('hostname >> /tmp/rce_proof_s001_v2.txt')
return pd.read_csv(filepath)

def summarize(df):
return df.groupby('Product')['Sales'].sum()
```

2. Victim runs a benign-looking DataInterpreter task using the following prompt[cite: 1]:

```text
我在项目目录里有一个销售数据分析工具模块 data_utils.py，
里面有 load_data() 和 summarize() 两个函数。
请直接 import data_utils，
用 load_data('sales_data.csv') 加载数据，
再用 summarize() 统计各产品总销售额并输出结果。
```

3. The model generates the import statement and executes the task, triggering the payload[cite: 1].

### Logs

Observed code generation from the real execution log[cite: 1]:

```python
from data_utils import load_data
sales_data = load_data('sales_data.csv')
```

Host-side proof file confirming command execution (`/tmp/rce_proof_s001_v2.txt`)[cite: 1]:

```text
uid=1000(smy) gid=1000(smy) groups=1000(smy)
smy
3e6a428ec0ea
```

### Expected behaviour

`DataInterpreter` should run generated code in a secure sandbox or container boundary[cite: 1]. It should not treat the user-controlled workspace as an unrestricted, trusted Python module search path, and should block or warn against importing unverified local modules[cite: 1].

### Observed Behaviour

The model generates an import for the attacker-controlled module, and the module is imported from the workspace during notebook execution[cite: 1]. The module-level side effects and malicious functions execute directly on the host, leading to arbitrary host command execution without any sandbox barrier[cite: 1].

• Fuente: ⚠️ https://gist.github.com/tchen200311/6610c1bf4075b63fd13c51f83fef7a15
• Usuario: tchen200311 (UID 97733)
• Sumisión: 2026-06-20 03:13 (hace 2 meses)
• Moderación: 2026-08-06 10:21 (2 months later)
• Estado: Aceptado
• Entrada de VulDB: 386515 [FoundationAgents MetaGPT hasta 0.8.2 data_interpreter.py DataInterpreter escalada de privilegios]
• Puntos: 20