PT-2026-45246

CVE-2026-10214

Published

2026-06-01

Updated

2026-06-01

Description by

CVSS 2.0

7.5

High

MetricsAV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions zhayujie chatgpt-on-wechat versions prior to 2.0.9

Description A weakness in the Bash Tool component allows for remote OS command injection. This occurs within the get safety warning() function located in the agent/tools/bash/bash.py file. OS command injection is a flaw that allows an attacker to execute arbitrary operating system commands on the server.

Recommendations Upgrade to version 2.0.9. As a temporary workaround, restrict the use of the get safety warning() function in the Bash Tool component.

Exploitability

Exploit

Fix

Impacts

Researchers

Eric-A

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')

Related identifiers