FoundationAgents MetaGPT versions 0.8.0 and 0.8.1 contain a server-side request forgery vulnerability in the decode_image function of metagpt/utils/common.py. By manipulating the img_url_or_b64 parameter, an attacker can cause the server to perform unauthorized requests to arbitrary URLs. This vulnerability is remotely exploitable without user interaction and has a CVSS 4.0 score of 5.3 (medium severity). The project has been notified but has not provided a fix or official remediation. No patch or workaround information is currently available.

Successful exploitation of this SSRF vulnerability can allow attackers to make the vulnerable server send crafted requests to internal or external systems, potentially leading to information disclosure or interaction with internal services not otherwise accessible. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability. There is no indication of active exploitation in the wild at this time.

No official fix or patch is currently available for this vulnerability. Users should monitor the FoundationAgents MetaGPT project for updates or advisories. Until a patch is released, consider restricting network access from the affected service to limit potential SSRF impact. Avoid exposing the vulnerable functionality to untrusted users or inputs. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.