CVE-2026-15330mediumCWE-918

CVE-2026-15330: fallo de gravedad media en zhayujie CowAgent

zhayujie CowAgent Vision Tool vision.py _download_to_data_url server-side request forgery

Publicada el

Seguir esta CVE+ Monitorear CowAgent

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

33Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 6.9epss 0.6%
A vulnerability was determined in zhayujie CowAgent up to 2.1.1. Impacted is the function _build_image_content/_download_to_data_url of the file agent/tools/vision/vision.py of the component Vision Tool. Executing a manipulation of the argument image can lead to server-side request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.1.2 is recommended to address this issue. This patch is called e85290cddcbb5ffc9c235927f4c92e5b4c3ec264. Upgrading the affected component is advised.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Productos afectados
zhayujie · CowAgent
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — zhayujie CowAgent

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-84427MEDIUMzhayujie CowAgent Bash Tool bash.py denial of serviceEPSS 0.5%CVE-2026-84425MEDIUMzhayujie CowAgent Browser Tool browser_tool.py BrowserTool denial of serviceEPSS 0.5%CVE-2026-16194MEDIUMzhayujie CowAgent web_fetch.py WebFetch.execute server-side request forgeryEPSS 0.5%CVE-2026-15331MEDIUMzhayujie CowAgent Skill Installation service.py _add_package path traversalEPSS 0.4%CVE-2026-15329MEDIUMzhayujie CowAgent Browser Tool browser_tool.py BrowserTool._do_navigate information disclosureEPSS 0.4%CVE-2026-18992MEDIUMzhayujie CowAgent Self-Evolution Review Agent executor.py _select_tools authorizationEPSS 0.4%