An OS command injection flaw exists in MetaGPT 0.8.1. The vulnerability lies in the function RepoParser.rebuild_class_views() where the path argument is passed directly to the operating system command executor. This allows an attacker who can influence the path value to run arbitrary shell commands on the host that runs MetaGPT. Successful exploitation grants full control over the underlying operating system, exposing the attacker to data theft, system compromise, and persistence mechanisms. The weakness is identified by CWE-78, OS Command Injection.

The affected product is MetaGPT version 0.8.1. No specific vendor or platform details are listed, but the issue impacts any host, container, or server that runs this version of MetaGPT and can supply a path argument to RepoParser.rebuild_class_views().

The CVSS score is not publicly listed, but OS command injection typically scores 9.x for availability, confidentiality, and integrity. The EPSS score is not available, and the vulnerability is not presently in the CISA KEV catalog. Nonetheless, because the flaw is exercised through user-controlled input and the path can be coerced by external users or API callers, exploitation could be carried out remotely if the MetaGPT instance is exposed over a network. The lack of a public exploit does not diminish the inherent risk; any system running the vulnerable code is at high risk of compromise if input is not validated.