The @aster110/cc2wechat package (version 5.1.0) implements a daemon that long-polls Tencent's iLink Bot API for incoming WeChat messages. Each message is forwarded to a local AI command-line interface configured with disabled approval and sandbox gates, allowing automatic execution of shell commands and filesystem operations without user prompts. The daemon uses tmux or an alternative backend to inject commands into the AI session. This design creates a remote shell attack surface: any party able to send a WeChat message to the linked account can execute arbitrary commands on the host machine. The remote shell surface is exposed only when the daemon is explicitly started via the CLI command `cc2wechat start`.

An attacker who can send messages to the linked WeChat account can execute arbitrary shell and filesystem commands on the host machine running the daemon. This effectively grants full host control to the attacker, posing a critical security risk. The package README documents that it requires a disposable VM due to this full-host access risk. There is no indication of active exploitation in the wild.

No official patch or fix is currently documented. Operators should avoid running the daemon unless in a fully isolated disposable virtual machine environment as recommended by the package documentation. Do not run the daemon on production or sensitive systems. Since the remote shell surface is only exposed when the daemon is started, avoid executing the `cc2wechat start` command unless absolutely necessary and in a secure environment. Monitor for updates or advisories from the package maintainer for any future remediation.