This vulnerability affects the check_cmd_exists function in FoundationAgents MetaGPT up to version 0.8.2. It allows an attacker to perform command injection by manipulating the mermaid.path argument. Although the attack vector is remote, exploitation is complex and difficult. The vulnerability was reported early to the project but remains unaddressed, and no official fix or remediation guidance is available. The CVSS 4.0 base score is 2.3, indicating low severity.

Successful exploitation could allow an attacker with limited privileges to execute arbitrary commands on the affected system remotely. However, the complexity and difficulty of exploitation reduce the likelihood of successful attacks. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, avoid exposing vulnerable versions to untrusted networks and consider restricting access to affected components.