CVE-2026-10566 is a deserialization vulnerability in FoundationAgents MetaGPT affecting versions 0.8.0 through 0.8.2. The issue exists in the Message.check_instruct_content function within metagpt/schema.py, where manipulation of the argument mapping enables unsafe deserialization. Exploitation requires local access with low privileges and no user interaction. The vulnerability has been publicly disclosed but no official patch or remediation guidance has been provided by the vendor as of the publication date.

Successful exploitation could allow an attacker with local access to manipulate deserialization processes, potentially leading to code execution or other impacts related to unsafe deserialization. The CVSS score of 4.8 indicates a medium severity impact with limited attack vector (local), low complexity, and no user interaction required.

No official fix or vendor advisory is currently available. Users should monitor vendor communications for updates. Until a patch is released, restrict local access to trusted users only and consider additional controls to limit exposure to this vulnerability.