CVE-2026-15330mediumCWE-918

CVE-2026-15330: medium-severity vulnerability in zhayujie CowAgent

zhayujie CowAgent Vision Tool vision.py _download_to_data_url server-side request forgery

Published

Follow this CVE+ Monitor CowAgent

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.9epss 0.6%
A vulnerability was determined in zhayujie CowAgent up to 2.1.1. Impacted is the function _build_image_content/_download_to_data_url of the file agent/tools/vision/vision.py of the component Vision Tool. Executing a manipulation of the argument image can lead to server-side request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.1.2 is recommended to address this issue. This patch is called e85290cddcbb5ffc9c235927f4c92e5b4c3ec264. Upgrading the affected component is advised.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
zhayujie · CowAgent
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — zhayujie CowAgent

In the same product, most dangerous first.

CVE-2026-84427MEDIUMzhayujie CowAgent Bash Tool bash.py denial of serviceEPSS 0.5%CVE-2026-84425MEDIUMzhayujie CowAgent Browser Tool browser_tool.py BrowserTool denial of serviceEPSS 0.5%CVE-2026-16194MEDIUMzhayujie CowAgent web_fetch.py WebFetch.execute server-side request forgeryEPSS 0.5%CVE-2026-15331MEDIUMzhayujie CowAgent Skill Installation service.py _add_package path traversalEPSS 0.4%CVE-2026-15329MEDIUMzhayujie CowAgent Browser Tool browser_tool.py BrowserTool._do_navigate information disclosureEPSS 0.4%CVE-2026-18992MEDIUMzhayujie CowAgent Self-Evolution Review Agent executor.py _select_tools authorizationEPSS 0.4%