This vulnerability exists in the evaluateCode function of the metagpt/environment/minecraft/mineflayer/index.js file in FoundationAgents MetaGPT up to version 0.8.1. It allows an attacker to perform cross-site request forgery attacks remotely, potentially causing unintended actions on behalf of an authenticated user. The vulnerability has been publicly disclosed, but the vendor has not yet issued a patch or official remediation guidance. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, no confidentiality or availability impact, and low integrity impact.

An attacker can exploit this vulnerability remotely to perform unauthorized actions by tricking an authenticated user into submitting a forged request. This could lead to unintended operations within the Mineflayer HTTP API component of MetaGPT. The impact is limited to integrity with no direct confidentiality or availability effects reported. No known exploits in the wild have been confirmed.

No official fix or patch is currently available from the vendor. Since the vendor has not responded or provided remediation guidance, users should consider implementing CSRF protections at the application or network level as a temporary mitigation. Monitor vendor communications for updates and apply patches promptly once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.