A critical OS command injection vulnerability (CVE-2026-10214) has been identified in zhayujie chatgpt-on-wechat versions up to 2.0.8. The vulnerability affects the _get_safety_warning function in the Bash Tool component and can be exploited remotely. A public exploit is available, making this a high-priority security issue. The vulnerability is fixed in version 2.0.9 with patch 16d9b449c9aa53ccee44144a762a2737d7ba4fc4. Organizations using the affected software should upgrade immediately to prevent potential exploitation.