A flaw in FoundationAgents MetaGPT disables proper neutralization of directives in dynamically evaluated code within the ActionNode.xml_fill function. This code evaluation vulnerability permits arbitrary code execution when an attacker supplies crafted input. An attacker who can influence the XML payload fed to this function could gain full control of the hosting environment, compromising confidentiality, integrity, and availability of the affected application. The description confirms that the exploit is published and usable, underscoring that the risk is not theoretical.

The vulnerability affects FoundationAgents MetaGPT versions up to 0.8.1. Users running any of those releases are potentially exposed. No specific patch versions are listed, but the CVE statement indicates that the component is the XML Handler in metagpt/actions/action_node.py.

The CVSS score of 6.9 shows a moderate to high severity, and no EPSS score is available, so precise exploitation probability is unknown. The vulnerability is not listed in CISA's KEV catalog, but the public availability of an exploit means that a remote attacker can exploit it. Given that the project has not yet responded to reported issues, the likelihood of a widespread attack remains significant, and the impact would be severe if execution succeeds.