CVE-2026-10214: chatgpt-on-wechat RCE Vulnerability

CVE-2026-10214 Overview

CVE-2026-10214 is an operating system command injection vulnerability in the zhayujie chatgpt-on-wechat project up to version 2.0.8. The flaw resides in the _get_safety_warning function within agent/tools/bash/bash.py, part of the Bash Tool component. An attacker can manipulate input passed to this function to inject and execute arbitrary OS commands on the host running the agent. The attack is exploitable remotely and requires no authentication or user interaction. A public exploit has been disclosed, increasing the likelihood of opportunistic use against exposed deployments. The maintainers addressed the issue in version 2.0.9 via commit 16d9b449c9aa53ccee44144a762a2737d7ba4fc4.

Critical Impact
Remote, unauthenticated attackers can inject operating system commands through the Bash Tool of chatgpt-on-wechat, leading to arbitrary command execution within the agent's runtime context.

Affected Products

zhayujie chatgpt-on-wechat versions up to and including 2.0.8
Affected component: Bash Tool (agent/tools/bash/bash.py)
Fixed in: chatgpt-on-wechat 2.0.9

Discovery Timeline

2026-06-01 - CVE CVE-2026-10214 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-10214

Vulnerability Analysis

The vulnerability is classified under [CWE-77] Improper Neutralization of Special Elements used in a Command. The _get_safety_warning function in agent/tools/bash/bash.py evaluates incoming text intended to gate or annotate shell commands routed through the Bash Tool. Because the function does not properly neutralize shell metacharacters, attacker-controlled input flows into a command execution path. The Bash Tool then dispatches the manipulated string to the underlying operating system shell.

Exploitation requires only network reachability to the agent's interaction surface, since chatgpt-on-wechat exposes conversational tool-use to remote chat clients. Because the agent typically runs with the privileges of the host user, successful injection grants those same privileges to the attacker. EPSS modeling places this issue in the 77th percentile, indicating elevated likelihood of exploitation activity compared to the broader CVE population.

Root Cause

The root cause is missing input sanitization inside _get_safety_warning. The function was designed as a safety check around bash invocations but processes attacker-influenced strings without escaping shell metacharacters such as ;, |, &&, backticks, and $(). Because the LLM-driven agent forwards user-derived content into this tool path, untrusted data reaches a shell context.

Attack Vector

A remote attacker interacts with the chatgpt-on-wechat agent through its supported messaging interface and crafts a prompt or tool invocation that traverses the Bash Tool code path. The attacker embeds shell metacharacters or chained commands in the input passed to _get_safety_warning. When the function processes the string, the appended commands execute in the agent's shell, yielding code execution under the agent process identity. No authentication is required, and the public exploit lowers the technical barrier for adversaries.

For technical details, see the GitHub Commit Update and the GitHub Issue Discussion.

Detection Methods for CVE-2026-10214

Indicators of Compromise

Unexpected child processes spawned by the chatgpt-on-wechat Python process, particularly /bin/sh, /bin/bash, curl, wget, nc, or python invocations originating from the agent runtime.
Outbound network connections from the agent host to unfamiliar IP addresses or pastebin-style domains shortly after chat interactions.
New cron jobs, SSH keys, or systemd units written under the agent service account.
Chat or webhook payloads containing shell metacharacters such as ;, &&, ||, `, or $(...) directed at the bash tool path.

Detection Strategies

Enable process-ancestry monitoring on hosts running the agent to flag any shell descendant of the chatgpt-on-wechat process tree.
Inspect application logs for invocations of _get_safety_warning and the Bash Tool, correlating them with the originating message content.
Apply pattern matching on inbound prompts for command-chaining syntax targeting the agent's tool interface.

Monitoring Recommendations

Forward agent host telemetry (process, file, and network events) to a centralized analytics platform for behavioral baselining.
Alert on outbound connections from the agent host to addresses outside an approved allowlist.
Track file integrity on authentication-related paths such as ~/.ssh/authorized_keys, /etc/cron.*, and /etc/systemd/system/.

How to Mitigate CVE-2026-10214

Immediate Actions Required

Upgrade chatgpt-on-wechat to version 2.0.9 or later, which includes patch commit 16d9b449c9aa53ccee44144a762a2737d7ba4fc4.
Restrict network exposure of the agent to trusted messaging endpoints only, and place the host behind authenticated proxies where feasible.
Run the agent under a dedicated low-privilege service account with no sudo rights and a restricted shell environment.
Review historical logs for prior abuse of the Bash Tool, including chat transcripts containing shell metacharacters.

Patch Information

The maintainers fixed the issue in chatgpt-on-wechat 2.0.9. The patch is tracked as commit 16d9b449c9aa53ccee44144a762a2737d7ba4fc4. Release notes and source are available in the GitHub Release Version 2.0.9 and the GitHub Commit Update. Additional context is published in the VulDB CVE-2026-10214 entry.

Workarounds

Disable the Bash Tool in the agent configuration until the upgrade is applied.
Execute the agent inside a hardened container with --read-only filesystem, dropped capabilities, and no-new-privileges enabled.
Apply egress filtering so the agent host cannot reach arbitrary internet destinations.
Add an input filter at the messaging gateway to reject payloads containing shell metacharacters destined for the bash tool path.

bash

# Configuration example: run chatgpt-on-wechat in a restricted container
docker run -d \
  --name chatgpt-on-wechat \
  --read-only \
  --cap-drop=ALL \
  --security-opt no-new-privileges:true \
  --user 10001:10001 \
  --network agent-net \
  -e DISABLE_BASH_TOOL=true \
  chatgpt-on-wechat:2.0.9