CVE-2026-84427: medium-severity vulnerability in zhayujie CowAgent
zhayujie CowAgent Bash Tool bash.py denial of service
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.5%
A vulnerability was determined in zhayujie CowAgent up to 2.1.7. Affected is an unknown function of the file agent/tools/bash/bash.py of the component Bash Tool. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
zhayujie · CowAgentpublic PoCs found — 1
cve_referencegithub.com/outlookgp/CVE/tree/main/CowAgent_Bash_Output_Buffer_DoS_Reportunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — zhayujie CowAgent
In the same product, most dangerous first.
CVE-2026-15330MEDIUMzhayujie CowAgent Vision Tool vision.py _download_to_data_url server-side request forgeryEPSS 0.6%CVE-2026-84425MEDIUMzhayujie CowAgent Browser Tool browser_tool.py BrowserTool denial of serviceEPSS 0.5%CVE-2026-16194MEDIUMzhayujie CowAgent web_fetch.py WebFetch.execute server-side request forgeryEPSS 0.5%CVE-2026-15331MEDIUMzhayujie CowAgent Skill Installation service.py _add_package path traversalEPSS 0.4%CVE-2026-15329MEDIUMzhayujie CowAgent Browser Tool browser_tool.py BrowserTool._do_navigate information disclosureEPSS 0.4%CVE-2026-18992MEDIUMzhayujie CowAgent Self-Evolution Review Agent executor.py _select_tools authorizationEPSS 0.4%