EUVD-2026-69782
GHSA-wh78-4m24-7957
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege credentials
-
DeliverySubmit crafted bash command to Bash Tool
-
ExploitTrigger unbounded output buffer growth
-
ExecutionExhaust agent process resources
-
ImpactCause denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource release
|
| Exploitation Conditions | Exploitation requires valid credentials or an access token sufficient to invoke the CowAgent Bash Tool (PR:L). The attacker must be able to submit arbitrary bash commands to the agent/tools/bash/bash.py endpoint or interface - meaning the Bash Tool feature must be enabled and reachable over the network. Limiting factors: authentication is required (unauthenticated exploitation is not possible per PR:L); impact is bounded to low availability degradation (VA:L) with no confidentiality or integrity consequence; and no subsequent system impact is indicated (SC:N/SI:N/SA:N). Deployments that restrict Bash Tool access to trusted internal users are at substantially reduced risk. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L) and score of 5.3 reflect a moderate, network-reachable DoS requiring only low-privilege authentication. The E:P supplemental metric confirms a public proof of concept exists, elevating real-world risk above a purely theoretical finding. However, impact is limited to low availability degradation on the vulnerable system with no confidentiality or integrity consequence. The PR:L requirement means anonymous exploitation is not possible - an attacker must hold valid credentials or an API key to invoke the Bash Tool. Real-world priority is moderate for deployments exposing CowAgent to untrusted or multi-tenant users; minimal for tightly access-controlled installations. |
| Exploit ScenarioDerived | A low-privileged user with API or UI access to a CowAgent instance submits a crafted bash command designed to generate unbounded output (e.g., a command producing infinite or extremely large stdout). The Bash Tool fails to cap or release the output buffer, exhausting memory or blocking the agent process until it becomes unresponsive. A public PoC demonstrating this output-buffer exhaustion pattern is available at the GitHub reference. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Denial of service in zhayujie CowAgent up to version 2.1.7 allows a low-privileged remote attacker to crash or degrade availability by manipulating input to the Bash Tool component (agent/tools/bash/bash.py). The root cause is CWE-404 (Improper Resource Shutdown or Release), suggesting the Bash Tool fails to bound, drain, or release output buffers when executing shell commands - consistent with the public PoC title 'CowAgent_Bash_Output_Buffer_DoS_Report'. A proof-of-concept exploit is publicly available on GitHub, though no patch has been released and the vendor was unresponsive to disclosure.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor was unresponsive to disclosure. As a compensating control, restrict access to the CowAgent Bash Tool to trusted, authenticated users only - prevent untrusted or anonymous principals from invoking bash-execution functionality. Implement output size limits and subprocess timeout enforcement in agent/tools/bash/bash.py by wrapping subprocess calls with stdout/stderr byte caps and a process timeout (e.g., Python subprocess timeout parameter and read size limits). Sandboxing the bash subprocess (e.g., via cgroups, ulimit, or container resource limits) can cap the blast radius of resource exhaustion. Monitor VulDB entry https://vuldb.com/vuln/397793 and the project's GitHub repository for a future patch release.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CowAgent (cpe:2.3:a:zhayujie:cowagent:*:*:*:*:*:*:*:*) is an AI agent framework written in Python. The vulnerable component is the Bash Tool (agent/tools/bash/bash.py), which executes shell commands on behalf of the agent. CWE-404 (Improper Resource Shutdown or Release) indicates that output produced by a crafted bash command - such as unbounded stdout/stderr streams - is not properly capped or released, causing resource exhaustion within the agent process. This is a classic output-buffering or pipe-drain DoS pattern in subprocess execution wrappers.
Know when Cowagent gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable with low-privilege auth required; impact is limited to low availability on the vulnerable system only.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in zhayujie CowAgent up to 2.1.7. Affected is an unknown function of the file agent/tools/bash/bash.py of the component Bash Tool. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in CowAgent Tool Resource Handling Flaws
View all 2Denial of service in zhayujie CowAgent through version 2.2.0 allows an authenticated, low-privileged user to disrupt the
Denial of service in zhayujie CowAgent through 2.2.0 lets a low-privilege authenticated remote attacker exhaust process
Denial of service in zhayujie CowAgent (up to and including 2.1.7) allows an authenticated remote user with low privileg
Denial of service in zhayujie CowAgent 2.1.6 and earlier allows an authenticated remote attacker with a low-privilege se
Server-side request forgery in zhayujie CowAgent up to version 2.1.1 allows low-privileged authenticated users to direct
Unbounded memory allocation in the media download handler of zhayujie CowAgent through version 2.1.9 allows an authentic
Information disclosure in zhayujie CowAgent up to version 2.1.0 exposes sensitive data to low-privileged authenticated r
Incorrect authorization in zhayujie CowAgent up to version 2.1.1 allows low-privilege authenticated remote attackers to
Exploit-DB