Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code because RunCode.run_script() passes shell metacharacters to subprocess.Popen.
Advisories for Pypi/Metagpt package
2024