# CVE-2026-10214: zhayujie chatgpt-on-wechat OS command injection in Bash Tool

Source: https://junglewise.ai/threats/cve-2026-10214-zhayujie-chatgpt-on-wechat-os-command-injection-in-bash-tool  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-10214 · Severity: high · CVSS 7.3 · Published 2026-06-01

A security vulnerability exists in chatgpt-on-wechat, a tool used to integrate AI chatbots with messaging platforms. An attacker can trick the AI into running unauthorized commands on the underlying server, potentially leading to a full system takeover or data theft. This occurs because the software's built-in safety filters for its command-line tool are easily bypassed.

Technologies: [Zhayujie Chatgpt-On-Wechat](https://junglewise.ai/threats/technologies/chatgpt-on-wechat). Vendors: [Zhayujie](https://junglewise.ai/threats/vendors/zhayujie).

## Quick answers

**Is CVE-2026-10214 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10214 being exploited in the wild.

**How severe is CVE-2026-10214?** High severity, with a CVSS score of 7.3, published 1 June 2026.

**Which products and versions are affected?** Zhayujie Chatgpt-On-Wechat up to 2.0.8.

**Is there a fix for CVE-2026-10214?** A patch was published on 2026-05-22: Version 2.0.9 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-10214 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-10214?** Check whether you run Zhayujie Chatgpt-On-Wechat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An unauthenticated remote code execution (RCE) vulnerability exists in the Bash Tool component of chatgpt-on-wechat. The vulnerability stems from the '_get_safety_warning' function in 'agent/tools/bash/bash.py', which utilizes a trivial exact-match blocklist to filter dangerous commands. Because the tool passes user-influenced strings directly to 'subprocess.run(shell=True)' without adequate sanitization or sandboxing, an attacker can bypass the filter using slightly altered payloads. This allows for arbitrary OS command execution via the application's unauthenticated '/message' interface. The issue is addressed in version 2.0.9 by binding the web console to localhost by default and improving security controls.

## Affected products

- zhayujie chatgpt-on-wechat (CowAgent) up to 2.0.8

## Timeline

- 2026-05-07: disclosed: Issue reported on GitHub by YLChen-007
- 2026-05-22: patched: Version 2.0.9 released
- 2026-06-01: advisory: CVE-2026-10214 published

## References

- [https://github.com/zhayujie/CowAgent/commit/16d9b449c9aa53ccee44144a762a2737d7ba4fc4](https://github.com/zhayujie/CowAgent/commit/16d9b449c9aa53ccee44144a762a2737d7ba4fc4)
- [https://github.com/zhayujie/CowAgent/issues/2803](https://github.com/zhayujie/CowAgent/issues/2803)
- [https://github.com/zhayujie/CowAgent/releases/tag/2.0.9](https://github.com/zhayujie/CowAgent/releases/tag/2.0.9)
- [https://vuldb.com/cve/CVE-2026-10214](https://vuldb.com/cve/CVE-2026-10214)
- [https://vuldb.com/submit/821929](https://vuldb.com/submit/821929)
- [https://vuldb.com/vuln/367493](https://vuldb.com/vuln/367493)
- [https://vuldb.com/vuln/367493/cti](https://vuldb.com/vuln/367493/cti)

## Related threats

- [zhayujie CowAgent SSRF in Vision Tool](https://junglewise.ai/threats/cve-2026-15628-zhayujie-cowagent-ssrf-in-vision-tool)
- [zhayujie CowAgent authentication bypass in WeChat MP endpoint](https://junglewise.ai/threats/cve-2026-14714-zhayujie-cowagent-authentication-bypass-in-wechat-mp-endpoint)