CVE-2026-6129 Details

A critical vulnerability allowing unauthenticated remote code execution has been identified in zhayujie chatgpt-on-wechat CowAgent versions 2.0.0 through 2.0.4. The issue arises from the Agent Mode Service, which is enabled by default and allows AI agents to access system-level tools, including a bash shell, file read/write capabilities, and web fetching. The vulnerability stems from the Web Console being exposed on all network interfaces at port 9899, without any authentication on key endpoints, such as '/message', which accepts chat instructions. This lack of authentication enables any remote attacker to send commands that the AI Agent will execute, effectively leveraging the Agent's OS-level access.

Users are advised to add authentication to all Web Console endpoints and change the default server binding to localhost. Additionally, the application should replace the current command blocklist with a more effective allowlist, and implement a user confirmation step before executing bash commands.