A flaw in the code_generate function of MetaGPT’s operator.py allows an attacker to inject arbitrary code. When the vulnerable method processes user input, the injected code can be executed by the running instance, granting the attacker remote execution powers. This can lead to full compromise of the server, data exfiltration, or further lateral movement. The weakness is classified as CWE‑74 (Code Injection) and CWE‑94 (Improper Control of Generation of Code).

The vulnerability affects Foundation Agents’ MetaGPT application up to version 0.8.1. Users running any of those releases are potentially exposed; no other versions are listed as affected.

The CVSS score of 5.3 indicates a moderate severity, while no EPSS score is available and the vulnerability is not in the CISA KEV catalog. The description states the attack can be initiated remotely, implying an internet-exposed or network-accessible instance may be exploited. Because a public exploit is already available, the risk is tangible for unpatched systems.