EUVD-2026-97126
GHSA-3495-753p-x98c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to CowAgent instance
-
ExploitSubmit crafted Markdown payload
-
ExecutionTrigger resource exhaustion in Markdown.tsx renderer
-
ImpactService availability degraded/denied
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource release
|
| Exploitation Conditions | Exploitation requires an authenticated/low-privileged session (CVSS PR:L) with the ability to submit Markdown content that is processed by CowAgent's Markdown Rendering component (Markdown.tsx) in versions up to and including 2.2.0. The limiting factors are: valid credentials/access to the application are needed (not unauthenticated), impact is confined to availability (no data disclosure or modification), and the flaw is reached only through the Markdown stream-rendering code path rather than arbitrary endpoints. No special non-default configuration is indicated in the description. |
| Impact | This is a low-priority issue despite being remotely exploitable. The CVSS 4.0 base score is only 2.1, driven by a vector of AV:N/AC:L/AT:N/PR:L/UI:N with impact limited to VA:L (low availability) and no confidentiality or integrity impact - consistent with the CWE-404 (improper resource shutdown/release) denial-of-service classification. The vector's PR:L indicates some level of authentication/privilege is required, which limits exposure. Public exploit code exists (E:P in the vector; VulDB-referenced GitHub PoC), which raises practical attack feasibility, but there is NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of active or widespread exploitation - PoC availability alone is not active exploitation. The only intelligence source is VulDB (a single reporter/aggregator), and the vendor did not respond to disclosure, meaning there is no vendor-confirmed advisory or patch. Net: a genuine but low-severity DoS requiring authentication against a niche product; prioritize behind any network-reachable, unauthenticated, or high-impact findings. |
| Exploit ScenarioDerived | An authenticated user of a CowAgent deployment sends specially crafted Markdown content that is processed by the Markdown.tsx streaming/rendering component, triggering improper resource handling that exhausts or hangs the rendering path and denies service to the application. A public proof-of-concept for this Markdown stream-render DoS has been released on GitHub, lowering the effort to reproduce. Because the CVSS vector requires low privileges (PR:L) and no user interaction, exploitation is feasible for any account holder but not for fully unauthenticated outsiders. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Denial of service in zhayujie CowAgent through version 2.2.0 allows an authenticated, low-privileged user to disrupt the availability of the Markdown Rendering component by submitting crafted Markdown content to the Markdown.tsx code path. The CVSS 4.0 score is only 2.1 (our independent CVSS 3.1 assessment is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), reflecting a low-impact, availability-only issue with no confidentiality or integrity loss. Publicly available exploit code exists (a proof-of-concept report is published in a GitHub repository), and the vendor was contacted early but did not respond, so no official patch or advisory is available; the flaw is not listed in CISA KEV and no active exploitation is confirmed.
RemediationAI
No vendor-released patch was identified at the time of analysis: the vendor was contacted early about the disclosure and did not respond, and there is no fixed version documented for CowAgent, so upgrade guidance cannot be given beyond tracking the project for a post-2.2.0 release. Because exploitation requires an authenticated low-privileged session (CVSS PR:L), the most effective compensating control is to restrict who can submit Markdown that reaches Markdown.tsx - gate the feature behind trusted roles, and treat any user-supplied Markdown as untrusted input. Additionally, cap and validate streamed Markdown input (maximum payload size, maximum nesting/depth, token or length limits) and add per-user rate limiting or timeouts around the rendering path so a single request cannot monopolize the renderer; the trade-off is that legitimate large or complex documents may be rejected or truncated. If the Markdown streaming renderer is not essential, disable or sandbox the component until a fix is available, at the cost of losing that formatting feature. Operators can validate exposure using the public PoC report at https://github.com/outlookgp/CVE/tree/main/CowAgent_Markdown_Stream_Render_DoS_Report and should monitor the VulDB entries (https://vuldb.com/vuln/416551) for a vendor fix; no patch URL or fixed version number should be assumed in the absence of one.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is classified as CWE-404 (Improper Resource Shutdown or Release) and lives in the Markdown Rendering component of CowAgent, specifically the file Markdown.tsx, which handles streamed Markdown output. Because the component processes attacker-influenced Markdown text as a stream, malformed or adversarial input can leave resources allocated or hold rendering state that is never properly released, degrading or stalling the rendering/service path rather than corrupting or exposing data. According to the CPE data (cpe:2.3:a:zhayujie:cowagent:*:*:*:*:*:*:*:*), all CowAgent releases up to and including 2.2.0 are affected; no version constraint beyond the 2.2.0 ceiling is documented. Reachability is limited to the Markdown stream-rendering code path rather than arbitrary endpoints, and per the CVSS vector the attacker needs a valid low-privileged session (PR:L) with network access (AV:N); no user interaction and no non-default configuration are indicated. There is no evidence of a memory-safety primitive, code execution, or data exposure - impact is confined to availability.
Know when Cowagent gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Remotely reachable Markdown rendering (AV:N/AC:L) but requires an authenticated low-privilege user (PR:L); impact is availability-only DoS, so C:N/I:N/A:L.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in zhayujie CowAgent up to 2.2.0. This affects an unknown part of the file Markdown.tsx of the component Markdown Rendering. The manipulation results in denial of service. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Denial of service in zhayujie CowAgent through 2.2.0 lets a low-privilege authenticated remote attacker exhaust process
Denial of service in zhayujie CowAgent (up to and including 2.1.7) allows an authenticated remote user with low privileg
Denial of service in zhayujie CowAgent 2.1.6 and earlier allows an authenticated remote attacker with a low-privilege se
Server-side request forgery in zhayujie CowAgent up to version 2.1.1 allows low-privileged authenticated users to direct
Unbounded memory allocation in the media download handler of zhayujie CowAgent through version 2.1.9 allows an authentic
Denial of service in zhayujie CowAgent up to version 2.1.7 allows a low-privileged remote attacker to crash or degrade a
Information disclosure in zhayujie CowAgent up to version 2.1.0 exposes sensitive data to low-privileged authenticated r
Incorrect authorization in zhayujie CowAgent up to version 2.1.1 allows low-privilege authenticated remote attackers to
Denial of service in zhayujie CowAgent up to version 2.1.3 allows a low-privileged remote attacker to crash or hang the
Exploit-DB