This vulnerability in FoundationAgents MetaGPT (<= 0.8.1) involves OS command injection in the get_mime_type function located in metagpt/utils/common.py. Remote attackers can manipulate input to this function to execute arbitrary operating system commands. The vulnerability was responsibly disclosed early through a pull request, but the vendor has not provided a fix or official response. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, no privileges required, and no user interaction needed. No patch or official remediation guidance is currently available.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected system, potentially leading to unauthorized system control or data compromise. The vulnerability does not require privileges or user interaction, increasing its risk. However, the impact is rated medium due to limited scope and lack of confirmed exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is available and the vendor has not reacted, users should monitor the vendor's channels for updates. Until a patch is released, consider restricting network access to the vulnerable service and applying any available application-level input validation or sandboxing as temporary mitigations.