The MetaGPT "Message.check_instruct_content" function deserializes instruction content provided via the argument mapping without sufficient validation. An attacker who can supply a crafted mapping can trigger Python’s deserialization process, potentially enabling arbitrary code execution on the host where MetaGPT runs. The flaw is limited to local execution, which means it does not expose the system to remote attacks directly, yet any local user or malware capable of influencing the input can exploit it.

Affected by the vulnerability are all instances of FoundationAgents MetaGPT version 0.8.2 and earlier. The flaw resides in metagpt/schema.py which is bundled with every release up to 0.8.2. No other vendors, products or component versions have been identified as affected.

The CVSS score of 4.8 indicates a moderate severity. Though the EPSS score is not available, the fact that the exploit is publicly released and can be executed locally suggests a realistic risk for organizations that run MetaGPT with elevated privileges. The vulnerability is not listed in CISA’s KEV catalog, implying the exploit may not yet be widely observed in the wild; nevertheless, any machine that can provide crafted instruction content to the vulnerable function is at risk. Security teams should treat local control of input as a critical point of failure until an official fix is released.