PT-2026-45246 · Zhayujie · Chatgpt-On-Wechat

Eric-A · CVE-2026-10214 · Published 2026-06-01 · Updated 2026-06-01

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions zhayujie chatgpt-on-wechat versions prior to 2.0.9

Description A weakness in the Bash Tool component allows for remote OS command injection. This occurs within the get safety warning() function located in the agent/tools/bash/bash.py file. OS command injection is a flaw that allows an attacker to execute arbitrary operating system commands on the server.

Recommendations Upgrade to version 2.0.9. As a temporary workaround, restrict the use of the get safety warning() function in the Bash Tool component.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2026-10214

Affected Products

Chatgpt-On-Wechat

References · 13

• 🔥 https://github.com/zhayujie/CowAgent/issues/2803 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10214.json · Exploit
• https://github.com/zhayujie/CowAgent/releases/tag/2.0.9 · Patch
• https://github.com/zhayujie/CowAgent/commit/16d9b449c9aa53ccee44144a762a2737d7ba4fc4 · Patch
• https://osv.dev/vulnerability/CVE-2026-10214 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-10214 · Security Note
• https://t.me/cveNotify/165406 · Telegram Post
• https://vuldb.com/vuln/367493 · Note
• https://vuldb.com/cve/CVE-2026-10214 · Note
• https://vuldb.com/vuln/367493/cti · Note
• https://vuldb.com/submit/821929 · Note
• https://t.me/CVEtracker/55416 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2061301369890386023 · Twitter Post