CVE-2026-10214: Command Injection in chatgpt-on-wechat Bash Tool

Technical summary

The vulnerability resides in the agent/tools/bash/bash.py file, specifically within the _get_safety_warning function of the Bash Tool component. The flaw allows improper neutralization of special elements used in an OS command (CWE-78), which stems from insufficient input validation (CWE-77). An unauthenticated remote attacker can craft malicious input that breaks out of the intended command context and inject arbitrary shell commands. The vulnerability requires no special privileges or user interaction to exploit, making it trivial to weaponize. The attack surface is network-accessible, and public exploit code is already available.

Business impact

This vulnerability enables unauthorized command execution on systems running vulnerable versions of chatgpt-on-wechat. An attacker gaining code execution can steal sensitive data, modify application behavior, establish persistence, or pivot to internal systems. For organizations using this tool in production or development environments, the risk is particularly acute if the service runs with elevated privileges or accesses confidential information. The presence of public exploits dramatically increases the likelihood of active exploitation, raising incident response and potential breach notification costs.

Affected systems

zhayujie chatgpt-on-wechat versions up to and including 2.0.8 are affected. The Bash Tool component is the attack vector. Any deployment running these versions is vulnerable if the Bash Tool is enabled or accessible. Organizations should audit their environment to confirm installed versions and the operational status of the Bash Tool.

Exploitability

This vulnerability carries a CVSS 3.1 score of 7.3 (HIGH severity). The attack requires no authentication, no user interaction, and only network access—all factors lowering the barrier to exploitation. The Network Access vector (AV:N), Low complexity (AC:L), and no privileges required (PR:N) make this a straightforward remote exploit. Public exploits are already available, eliminating the need for attackers to develop working code independently. The combination of low friction and active exploitation in the wild indicates this threat should be treated with urgency.

Remediation

Upgrade chatgpt-on-wechat to version 2.0.9 or later. The patch commit hash is 16d9b449c9aa53ccee44144a762a2737d7ba4fc4, which addresses the command injection in the _get_safety_warning function. Verify that the upgrade is applied across all instances, including development, staging, and production environments. If immediate upgrading is not feasible, consider disabling the Bash Tool component until patching can be completed.

Patch guidance

Deploy version 2.0.9 of chatgpt-on-wechat as soon as possible. Review vendor release notes and any breaking changes associated with this version. Test the patch in a non-production environment first to ensure compatibility with your deployment. Verify the patch commit (16d9b449c9aa53ccee44144a762a2737d7ba4fc4) matches your installed version to confirm successful patching. Monitor application logs post-upgrade for any anomalies. Consider enabling automated dependency scanning to detect future vulnerable versions early.

Detection guidance

Hunt for exploitation attempts by monitoring application and system logs for unusual command execution patterns originating from the chatgpt-on-wechat process, particularly involving shell metacharacters or unexpected system commands. Search for HTTP requests or API calls to the affected Bash Tool endpoint containing encoded or obfuscated payloads. Monitor process trees for child processes spawned by the application that are inconsistent with normal operation. Implement network intrusion detection signatures targeting known public exploits for this vulnerability. Check audit logs for file modifications or privilege escalations coinciding with suspicious application behavior.

Why prioritize this

This vulnerability merits immediate attention due to the combination of high CVSS score (7.3), unauthenticated remote exploitability, active public exploitation, and the severity of command injection impacts. The low complexity and absence of required privileges mean almost any network-connected attacker can weaponize this vulnerability. Organizations should treat this as a critical patch priority and deploy remediation within 24-48 hours if operationally feasible.

Risk score, explained

The CVSS 3.1 score of 7.3 reflects the critical exploitability factors: network accessibility (AV:N), low attack complexity (AC:L), no authentication required (PR:N), and no user interaction needed (UI:N). The impact scope is unchanged (S:U), but the confidentiality, integrity, and availability impacts are all rated as Low (C:L/I:L/A:L), meaning a compromised system experiences some degradation across all three pillars. In real-world context, the score is amplified by the presence of public exploits and active exploitation, warranting treatment as a higher-priority issue than the numeric score alone suggests.

Frequently asked questions