EUVD-2026-42788
GHSA-2xj7-6vvg-p9hp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible SSRF with no authentication or interaction; low C/I from internal request proxying; no direct availability impact attributable to SSRF itself.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was determined in zhayujie CowAgent up to 2.1.1. Impacted is the function _build_image_content/_download_to_data_url of the file agent/tools/vision/vision.py of the component Vision Tool. Executing a manipulation of the argument image can lead to server-side request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.1.2 is recommended to address this issue. This patch is called e85290cddcbb5ffc9c235927f4c92e5b4c3ec264. Upgrading the affected component is advised.
AnalysisAI
Server-side request forgery in zhayujie CowAgent versions up to 2.1.1 allows remote unauthenticated attackers to manipulate the image argument passed to _build_image_content or _download_to_data_url within the Vision Tool component, forcing the server to issue arbitrary outbound HTTP requests to attacker-specified destinations. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication and no special conditions, making this trivially accessible over the network. Exploit code has been publicly disclosed (CVSS 4.0 E:P per VulDB submission), raising real-world risk; no CISA KEV listing exists at time of analysis, so confirmed mass exploitation is not established.
Technical ContextAI
CowAgent is an open-source AI agent chatbot framework by zhayujie that orchestrates LLM-backed tools. The vulnerable component is the Vision Tool (agent/tools/vision/vision.py), which provides multimodal image-processing capability. The functions _build_image_content and _download_to_data_url accept a user-supplied image argument - expected to be a URL or image path - and retrieve the resource server-side without adequate input validation or allowlist enforcement. CWE-918 (Server-Side Request Forgery) identifies the root cause: the application acts as a proxy on behalf of the attacker, forwarding requests to destinations the attacker controls. In cloud-hosted deployments this commonly exposes the AWS/GCP/Azure instance metadata service (e.g., 169.254.169.254), internal microservices, or other RFC-1918 resources inaccessible from the public internet. No CPE string was provided in the input data; affected versions are 2.1.0 and 2.1.1 per EUVD-2026-42788.
RemediationAI
Upgrade to CowAgent version 2.1.2, which resolves this issue via commit e85290cddcbb5ffc9c235927f4c92e5b4c3ec264 (https://github.com/zhayujie/CowAgent/commit/e85290cddcbb5ffc9c235927f4c92e5b4c3ec264); the release is available at https://github.com/zhayujie/CowAgent/releases/tag/2.1.2. If an immediate upgrade is not feasible, apply egress firewall rules to block outbound requests from the CowAgent process to cloud metadata endpoints (169.254.169.254, fd00:ec2::254) and RFC-1918 internal address ranges - this significantly limits SSRF impact in cloud environments but does not eliminate the vulnerability and may break legitimate Vision Tool use cases if internal URLs are expected. Alternatively, disabling the Vision Tool feature entirely until patching is completed eliminates exposure with no residual risk, at the cost of losing image-input capability.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today