security: replace eval() with safe parsers to prevent arbitrary code execution

[anxovatomica]

Summary

Replaces dangerous eval() calls with safe alternatives (ast.literal_eval(), json.loads()) across three core components.

Vulnerability

eval() was used to parse LLM-generated output and serialized mapping data. An attacker can achieve arbitrary code execution via prompt injection by crafting inputs that cause the LLM to output malicious Python code.

Affected code paths

1. metagpt/actions/action_node.py — fill() method evaluates raw_value from LLM XML-tagged output:

   extracted_data[field_name] = eval(raw_value)  # RCE if LLM injects malicious code

2. metagpt/strategy/tot.py — generate_thoughts() evaluates LLM JSON output:

   thoughts = eval(thoughts)  # RCE if LLM outputs __import__('os').system('id')

3. metagpt/utils/serialize.py — actionoutput_str_to_mapping() evaluates serialized strings:

   new_mapping[key] = eval(value)  # RCE if serialized mapping is poisoned

Fix

• eval() → ast.literal_eval() for Python literal parsing (lists, dicts, tuples)
• eval() → json.loads() for JSON parsing in TOT strategy

Impact

Eliminates arbitrary code execution via prompt injection (CWE-94). Multi-tenant deployments where untrusted users can trigger LLM calls are now safe from this attack vector.