The vulnerability resides in the get_mime_type function within MetaGPT's common utilities, allowing an attacker to inject and execute arbitrary operating‑system commands. A specially crafted input is processed without proper sanitization, giving the attacker full control over system commands run by the MetaGPT process. Execution of malicious commands can lead to compromise of confidentiality, integrity, and availability of the host system, as well as any data processed by the application.

FoundationAgents MetaGPT versions up to 0.8.1 are affected. No other vendors or products are listed as impacted. The vulnerability resides in the MetaGPT repository hosted by FoundationAgents.

The CVSS score of 6.9 indicates a score in the medium‑to‑high range. The Exploit Prediction Scoring System (EPSS) value is 2%, indicating a low probability of exploitation, but a public exploit is already documented, and the vulnerability can be triggered remotely without authentication, as inferred from the description. The absence of a KEV listing does not reduce the risk; the active public exploit and lack of a timely fix leave unpatched installations at considerable risk of compromise.