A critical vulnerability (CVE-2026-10214) has been identified in zhayujie chatgpt-on-wechat versions up to 2.0.8. The vulnerability affects the _get_safety_warning function in the Bash Tool component, allowing for OS command injection attacks. The vulnerability can be exploited remotely and public exploits are available. Users should upgrade to version 2.0.9 which includes patch 16d9b449c9aa53ccee44144a762a2737d7ba4fc4 to address this security issue.