CVE-2026-16194mediumCWE-918

CVE-2026-16194: medium-severity vulnerability in zhayujie CowAgent

zhayujie CowAgent web_fetch.py WebFetch.execute server-side request forgery

Published · Updated

Follow this CVE+ Monitor CowAgent

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.3epss 0.5%
A vulnerability was determined in zhayujie CowAgent up to 2.1.1. This affects the function WebFetch.execute of the file agent/tools/web_fetch/web_fetch.py. Executing a manipulation of the argument url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.1.2 is able to mitigate this issue. This patch is called ea47f3097eed4f8295c4cb3d76ecb97e0f43d632. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
zhayujie · CowAgent
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — zhayujie CowAgent

In the same product, most dangerous first.

CVE-2026-15330MEDIUMzhayujie CowAgent Vision Tool vision.py _download_to_data_url server-side request forgeryEPSS 0.6%CVE-2026-84427MEDIUMzhayujie CowAgent Bash Tool bash.py denial of serviceEPSS 0.5%CVE-2026-84425MEDIUMzhayujie CowAgent Browser Tool browser_tool.py BrowserTool denial of serviceEPSS 0.5%CVE-2026-15331MEDIUMzhayujie CowAgent Skill Installation service.py _add_package path traversalEPSS 0.4%CVE-2026-15329MEDIUMzhayujie CowAgent Browser Tool browser_tool.py BrowserTool._do_navigate information disclosureEPSS 0.4%CVE-2026-18992MEDIUMzhayujie CowAgent Self-Evolution Review Agent executor.py _select_tools authorizationEPSS 0.4%