CVE-2026-108768: medium-severity vulnerability in zhayujie CowAgent
zhayujie CowAgent Streaming Tool-Call Argument json.loads allocation of resources
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.3%
A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of the component Streaming Tool-Call Argument Handler. The manipulation leads to allocation of resources. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
zhayujie · CowAgentpublic PoCs found — 1
cve_referencegithub.com/lche511/cve/tree/main/CowAgent_Tool_Call_Arguments_JSON_Repair_DoS_Reportunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — zhayujie CowAgent
In the same product, most dangerous first.
CVE-2026-15330MEDIUMzhayujie CowAgent Vision Tool vision.py _download_to_data_url server-side request forgeryEPSS 0.6%CVE-2026-84427MEDIUMzhayujie CowAgent Bash Tool bash.py denial of serviceEPSS 0.5%CVE-2026-84425MEDIUMzhayujie CowAgent Browser Tool browser_tool.py BrowserTool denial of serviceEPSS 0.5%CVE-2026-16194MEDIUMzhayujie CowAgent web_fetch.py WebFetch.execute server-side request forgeryEPSS 0.5%CVE-2026-15331MEDIUMzhayujie CowAgent Skill Installation service.py _add_package path traversalEPSS 0.4%CVE-2026-15329MEDIUMzhayujie CowAgent Browser Tool browser_tool.py BrowserTool._do_navigate information disclosureEPSS 0.4%