The flaw resides in the Terminal.run_command function of MetaGPT’s terminal library, allowing attackers to inject arbitrary OS commands. This results in execution of malicious code on the host machine, giving potential unrestricted control. The vulnerability is classified as command injection (CWE‑77 & CWE‑78) and has a CVSS base score of 6.9, indicating moderate severity.

FoundationAgents’ MetaGPT versions up to 0.8.1 are affected, specifically the metagpt/tools/libs/terminal.py component. Any deployment of MetaGPT 0.8.1 or earlier that exposes the terminal functionality is vulnerable. The product is maintained by FoundationAgents and available on GitHub.

The CVSS score of 6.9 reflects moderate risk, yet the flaw allows remote exploitation, meaning an attacker can trigger the injection through a network or API interface. EPSS data is not provided, and the issue is not listed in CISA’s KEV catalog, but a public exploit has already been posted on GitHub. The likely attack vector is remote: an attacker supplies malicious input to Terminal.run_command, which is executed without sanitization. Exploitation requires that the terminal API is exposed and accessible to the attacker, so proper isolation or access control can mitigate the risk.