An OS command injection flaw exists in MetaGPT 0.8.1. The weakness lies in the function RepoParser.rebuild_class_views(), where the path argument is passed directly to the operating system without validation. This allows an attacker who can influence the path value to run arbitrary shell commands on the host running MetaGPT, giving full control over the underlying operating system.

The vulnerable component is MetaGPT version 0.8.1. Any host, container, or server executing this version and allowing an external caller to provide a path argument to RepoParser.rebuild_class_views() is affected; the problem does not depend on vendor or platform, just on the presence of this specific code path.

The CVSS score of 9.8 indicates a remote code execution vulnerability that can be leveraged from a network or local user with sufficient privileges. The EPSS score of < 1% shows that exploitation attempts are low in the wild, but the presence of an unfiltered command execution path remains a high risk. The vulnerability is not in CISA’s KEV catalog, but any exposure of the vulnerable API or endpoint can be used to launch attacks remotely if the input can be controlled by an attacker.