CVE-2026-10214

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-10214
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10214.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-10214
Published
2026-06-01T02:00:11.274Z
Modified
2026-07-24T03:56:58.365297357Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
zhayujie chatgpt-on-wechat Bash Tool bash.py _get_safety_warning os command injection
Details

A weakness has been identified in zhayujie chatgpt-on-wechat up to 2.0.8. This issue affects the function getsafety_warning of the file agent/tools/bash/bash.py of the component Bash Tool. Executing a manipulation can lead to os command injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.0.9 is capable of addressing this issue. This patch is called 16d9b449c9aa53ccee44144a762a2737d7ba4fc4. It is recommended to upgrade the affected component.

Database specific 
{
    "cwe_ids": [
        "CWE-77",
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10214.json",
    "cna_assigner": "VulDB"
}
References

Affected packages

Git / github.com/zhayujie/cowagent

Affected ranges

Type
GIT
Repo
https://github.com/zhayujie/cowagent
Events
Introduced
ce63de3c58910ce637577733c1a673e4e0ec55cb
Fixed
16d9b449c9aa53ccee44144a762a2737d7ba4fc4
Fixed
069bffa3e8f076a0cd0dd29fa473c42a777ad06b
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "2.0.0"
        },
        {
            "last_affected": "2.0.0"
        },
        {
            "introduced": "2.0.1"
        },
        {
            "last_affected": "2.0.1"
        },
        {
            "introduced": "2.0.2"
        },
        {
            "last_affected": "2.0.2"
        },
        {
            "introduced": "2.0.3"
        },
        {
            "last_affected": "2.0.3"
        },
        {
            "introduced": "2.0.4"
        },
        {
            "last_affected": "2.0.4"
        },
        {
            "introduced": "2.0.5"
        },
        {
            "last_affected": "2.0.5"
        },
        {
            "introduced": "2.0.6"
        },
        {
            "last_affected": "2.0.6"
        },
        {
            "introduced": "2.0.7"
        },
        {
            "last_affected": "2.0.7"
        },
        {
            "introduced": "2.0.8"
        },
        {
            "last_affected": "2.0.8"
        }
    ]
}

Affected versions

2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10214.json"