EUVD-2026-42789
GHSA-c3mj-x5cv-cphr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable skill installer requires low-privilege authentication (PR:L); path traversal enables limited out-of-bounds file writes (I:L) and potential disruption (A:L) with no confidentiality impact.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was identified in zhayujie CowAgent up to 2.1.0. The affected element is the function _add_url/_add_package of the file agent/skills/service.py of the component Skill Installation Handler. The manipulation of the argument Name leads to path traversal. The attack may be initiated remotely. Upgrading to version 2.1.2 is sufficient to fix this issue. The identifier of the patch is e85290cddcbb5ffc9c235927f4c92e5b4c3ec264. It is advisable to upgrade the affected component.
AnalysisAI
Path traversal in zhayujie CowAgent versions up to 2.1.0 allows remote low-privilege authenticated attackers to write files outside the intended skill installation directory by manipulating the Name argument in the Skill Installation Handler. The flaw resides in the _add_url and _add_package functions within agent/skills/service.py, which fail to sanitize path components before constructing filesystem paths during skill installation. No public exploit or active exploitation confirmed (no CISA KEV listing); a vendor-released patch exists in version 2.1.2.
Technical ContextAI
CowAgent is an open-source Python-based AI agent framework maintained by zhayujie that supports dynamic skill installation - allowing users to extend agent capabilities at runtime by loading new modules via URL or package name. The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The _add_url and _add_package functions in agent/skills/service.py accept a user-supplied Name argument and use it to construct a target filesystem path without stripping or rejecting directory traversal sequences such as ../. This allows an attacker to escape the designated skills directory and write to arbitrary locations accessible by the process. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms the attack is remotely reachable, requires no special conditions, and demands only low-level authentication - consistent with a web-accessible API endpoint gating skill installation behind a user account.
RemediationAI
Upgrade CowAgent to version 2.1.2 or later, which is confirmed by the vendor via the GitHub release at https://github.com/zhayujie/CowAgent/releases/tag/2.1.2. The fix is implemented in commit e85290cddcbb5ffc9c235927f4c92e5b4c3ec264 (referenced in pull request https://github.com/zhayujie/CowAgent/pull/2886) and addresses unsafe path construction in the _add_url and _add_package functions. If an immediate upgrade is not possible, the most effective compensating control is to disable the external skill installation feature entirely if not required in your deployment - this eliminates the vulnerable code path at the cost of losing dynamic skill loading capability. Alternatively, restrict access to the Skill Installation Handler to trusted high-privilege administrators only, and apply OS-level filesystem containment (e.g., run CowAgent in a chroot jail or container with a read-only root filesystem and a narrowly scoped writable volume) to limit the directories the process can write to, reducing the blast radius of a successful traversal.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today