The vulnerability resides in the actionoutput_str_to_mapping function of Foundation Agents MetaGPT, where a user-supplied string is evaluated as Python code without proper validation. This flaw permits an attacker to inject arbitrary code, leading to remote execution over the service account. The weakness is identified as code injection (CWE‑94) and, due to the lack of authentication requirements, an attacker can use it without any prior access credentials.

Affected installations include the Foundation Agents MetaGPT tool, specifically version 0.8.1 as referenced by its CPE entry. Users running this version should verify the installed package and consider it vulnerable until a fix is applied.

The CVSS score of 9.8 classifies the flaw as critical, and the EPSS score of 3% indicates a non-negligible likelihood of exploitation. The vulnerability is not currently listed in the CISA KEV catalog. Attackers can likely target any exposed interface that accepts the actionoutput string, and exploitation is possible without authentication, suggesting a remote network attacker could compromise the system. Strong risk remains until remediation is applied.