Is there a public PoC exploit available for EUVD-2026-33535?

Yes, a public proof-of-concept exploit is available for EUVD-2026-33535. Prioritise patching immediately. EPSS: 0.8%.

chatgpt-on-wechat EUVD-2026-33535

Q: What is the CVSS score of EUVD-2026-33535?

EUVD-2026-33535 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

Q: Which versions of chatgpt-on-wechat are affected by EUVD-2026-33535?

A remote command injection vulnerability in chatgpt-on-wechat (versions ≤2.0.8) enables attackers to execute arbitrary operating system commands on affected systems, risking complete infrastructure…. A patch is available.

Q: How to fix or mitigate EUVD-2026-33535?

Within 24 hours: Inventory all systems running chatgpt-on-wechat versions 2.0.8 and earlier. Within 7 days: Upgrade all affected deployments to version 2.0.9 (commit 16d9b449c9aa53ccee44144a762a2737d7ba4fc4). Within 30 days: Verify completion of patches across all environments and conduct log review for indicators of prior exploitation attempts.

| CVE-2026-10214 MEDIUM

OS Command Injection (CWE-78)

2026-06-01 VulDB

GHSA-qvrw-783g-pmvr

Command Injection Chatgpt On Wechat Zhayujie

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 01, 2026 - 03:22 NVD

HIGH MEDIUM

CVSS changed

Jun 01, 2026 - 03:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Source Code Evidence Fetched

Jun 01, 2026 - 02:43 vuln.today

Analysis Generated

Jun 01, 2026 - 02:43 vuln.today

DescriptionCVE.org

A weakness has been identified in zhayujie chatgpt-on-wechat up to 2.0.8. This issue affects the function _get_safety_warning of the file agent/tools/bash/bash.py of the component Bash Tool. Executing a manipulation can lead to os command injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.0.9 is capable of addressing this issue. This patch is called 16d9b449c9aa53ccee44144a762a2737d7ba4fc4. It is recommended to upgrade the affected component.

AnalysisAI

OS command injection in zhayujie chatgpt-on-wechat (also known as CowAgent) versions up to and including 2.0.8 allows remote attackers to execute arbitrary operating system commands by abusing the _get_safety_warning function within the Bash Tool component (agent/tools/bash/bash.py). Publicly available exploit code exists for this issue, increasing the likelihood of opportunistic abuse, though it is not currently listed in CISA KEV. The vendor has released version 2.0.9 (commit 16d9b449c9aa53ccee44144a762a2737d7ba4fc4) addressing the flaw.

Technical ContextAI

chatgpt-on-wechat (rebranded CowAgent) is a Python-based agent framework that bridges large language model chat capabilities to WeChat and other channels, exposing a web console and agent tooling including a Bash Tool that can execute shell commands as part of agent workflows. The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), specifically located in the _get_safety_warning function of agent/tools/bash/bash.py, where input intended to be evaluated for safety is instead passed in a way that permits injection of additional shell metacharacters or commands. The CPE cpe:2.3:a:zhayujie:chatgpt-on-wechat covers all versions of the product up to the fix, and the related patch commit on the CowAgent repository also tightens the web console's default bind behavior (web_host) and password handling, indicating that exposure of the Bash Tool is closely tied to how the web channel is deployed.

RemediationAI

Vendor-released patch: upgrade to chatgpt-on-wechat / CowAgent version 2.0.9 or later, which incorporates commit 16d9b449c9aa53ccee44144a762a2737d7ba4fc4 fixing the Bash Tool input handling, available at https://github.com/zhayujie/CowAgent/releases/tag/2.0.9 with the diff at https://github.com/zhayujie/CowAgent/commit/16d9b449c9aa53ccee44144a762a2737d7ba4fc4. If immediate upgrade is not possible, restrict reachability of the agent and web console by setting web_host to 127.0.0.1 in config.json (the 2.0.9 release changes the default to localhost-only, so replicating this manually is an effective interim control at the cost of losing remote console access), and if 0.0.0.0 binding is required set a strong web_password to gate access - note this only blunts opportunistic exploitation and does not prevent abuse by anyone with valid console credentials. As a deeper compensating control, disable or remove the Bash Tool from the agent's tool registry so that arbitrary shell execution paths are not exposed, accepting that any agent workflows depending on shell execution will break; corroborating advisory information is tracked at https://vuldb.com/vuln/367493.