Description
A weakness has been identified in zhayujie chatgpt-on-wechat up to 2.0.8. This issue affects the function _get_safety_warning of the file agent/tools/bash/bash.py of the component Bash Tool. Executing a manipulation can lead to os command injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.0.9 is capable of addressing this issue. This patch is called 16d9b449c9aa53ccee44144a762a2737d7ba4fc4. It is recommended to upgrade the affected component.
Published: 2026-06-01
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the _get_safety_warning function of the Bash Tool in zhayujie chatgpt‑on‑wechat allows an attacker to inject operating‑system commands via unsanitized input. The vulnerability is limited to this helper function, but the injected commands can be used to execute arbitrary code, compromising the confidentiality, integrity, and availability of the host. The weakness maps to CWE‑77 and CWE‑78, indicating a lack of proper input validation for system command execution.

Affected Systems

The flaw exists in all releases of zhayujie chatgpt‑on‑wechat up to version 2.0.8. Users running these or earlier releases are vulnerable. An update to version 2.0.9, which includes the patch identified by commit 16d9b449c9aa53ccee44144a762a2737d7ba4fc4, resolves the issue.

Risk and Exploitability

The vulnerability has a CVSS score of 6.9, denoting moderate severity, and there is no EPSS score available. It is not listed in CISA’s KEV catalog. The attack can be launched remotely, and the exploit is publicly available, meaning an attacker could readily target exposed deployments of this component.

Generated by OpenCVE AI on June 1, 2026 at 03:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the chatgpt‑on‑wechat application to version 2.0.9.
  • Temporarily disable the Bash Tool component or restrict its use until the patch is applied.
  • Implement monitoring and alerting for unexpected command execution or usage of unsafe inputs to detect exploitation attempts.

Generated by OpenCVE AI on June 1, 2026 at 03:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 01 Jun 2026 02:30:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in zhayujie chatgpt-on-wechat up to 2.0.8. This issue affects the function _get_safety_warning of the file agent/tools/bash/bash.py of the component Bash Tool. Executing a manipulation can lead to os command injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.0.9 is capable of addressing this issue. This patch is called 16d9b449c9aa53ccee44144a762a2737d7ba4fc4. It is recommended to upgrade the affected component.
Title zhayujie chatgpt-on-wechat Bash Tool bash.py _get_safety_warning os command injection
First Time appeared Zhayujie
Zhayujie chatgpt-on-wechat
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:zhayujie:chatgpt-on-wechat:*:*:*:*:*:*:*:*
Vendors & Products Zhayujie
Zhayujie chatgpt-on-wechat
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Zhayujie Chatgpt-on-wechat
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-06-01T02:00:11.274Z

Reserved: 2026-05-31T07:19:15.835Z

Link: CVE-2026-10214

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-06-01T03:16:25.123

Modified: 2026-06-01T03:16:25.123

Link: CVE-2026-10214

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-01T04:00:12Z

Weaknesses