This vulnerability in FoundationAgents MetaGPT up to version 0.8.2 allows an attacker with local access to perform code injection via the DataInterpreter function in metagpt/roles/di/data_interpreter.py. The flaw enables execution of arbitrary code due to improper handling of input data. The vulnerability has been publicly disclosed with exploit code available, but no official remediation or patch has been provided by the vendor as of the publication date.

An attacker with local access and limited privileges can exploit this vulnerability to inject and execute arbitrary code within the context of the MetaGPT application. This could lead to unauthorized actions or compromise of the affected system. The impact is limited by the requirement for local access and the medium CVSS score reflects this constrained attack vector and complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should restrict local access to trusted users only and monitor for suspicious activity related to the DataInterpreter function. Consider applying additional local security controls to mitigate risk until an official patch is released.