The vulnerability in FoundationAgents MetaGPT up to version 0.8.2 allows an attacker with local access to perform a path traversal attack via the read function in metagpt/tools/libs/editor.py. This could enable the attacker to read arbitrary files on the system by manipulating file paths. The issue has been publicly disclosed, but no official patch or remediation has been provided by the vendor as of the publication date.

An attacker with local access can exploit this vulnerability to read arbitrary files on the affected system, potentially exposing sensitive information. The attack does not require user interaction and has low complexity but requires local privileges. There is no indication of remote exploitation or privilege escalation from the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should restrict local access to trusted users only and monitor for any suspicious local activity related to file access in MetaGPT. Avoid running MetaGPT in untrusted environments until a fix is released.