This vulnerability exists in FoundationAgents MetaGPT (<= 0.8.1) within the get_mime_type function of metagpt/utils/common.py. Improper input handling leads to OS command injection, enabling remote attackers to execute arbitrary commands on the affected system. The vulnerability was responsibly disclosed early to the project via a pull request, but no patch or official fix has been released as of the publication date. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, no privileges required, and no user interaction needed. The vulnerability state is published, but remediation level is unknown.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on affected installations of MetaGPT up to version 0.8.1. This could lead to unauthorized system control or data compromise depending on the privileges of the MetaGPT process. There are no confirmed exploitations in the wild, but public exploit code availability increases risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch has been released, users should consider applying manual mitigations such as disabling or restricting access to the vulnerable function if possible, or isolating affected instances until a vendor patch is available. Monitor vendor channels for updates and apply patches promptly once released.