Cowagent
Monthly
Denial of service in zhayujie CowAgent up to version 2.1.7 allows a low-privileged remote attacker to crash or degrade availability by manipulating input to the Bash Tool component (agent/tools/bash/bash.py). The root cause is CWE-404 (Improper Resource Shutdown or Release), suggesting the Bash Tool fails to bound, drain, or release output buffers when executing shell commands - consistent with the public PoC title 'CowAgent_Bash_Output_Buffer_DoS_Report'. A proof-of-concept exploit is publicly available on GitHub, though no patch has been released and the vendor was unresponsive to disclosure.
Denial of service in zhayujie CowAgent up to version 2.1.3 allows a low-privileged remote attacker to crash or hang the agent service by sending a crafted input to the BrowserTool component in `agent/tools/browser/browser_tool.py`. The underlying cause (CWE-404) is improper resource shutdown or release - likely a browser subprocess or evaluation call that hangs indefinitely rather than timing out cleanly. A public proof-of-concept exists on GitHub; the vendor was unresponsive to disclosure, and no patch has been released.
Incorrect authorization in zhayujie CowAgent up to version 2.1.1 allows low-privilege authenticated remote attackers to bypass access controls in the Self-Evolution Review Agent component. The flaw resides in the _select_tools function of agent/evolution/executor.py (CWE-863), where authorization logic is implemented incorrectly, potentially permitting access to tools or agent capabilities outside the caller's intended permission scope. Publicly available exploit code exists (E:P in CVSS 4.0 vector), though active exploitation has not been confirmed by CISA KEV.
Server-side request forgery in zhayujie CowAgent up to version 2.1.1 allows low-privileged authenticated users to direct the server to issue arbitrary HTTP requests by supplying a crafted URL to the WebFetch.execute function, enabling internal network reconnaissance and cloud metadata credential theft. The WebFetch tool lacked any IP-range validation, leaving loopback, RFC1918, link-local, and cloud metadata endpoints (e.g., 169.254.169.254) fully reachable from the server. A public proof-of-concept exists (GitHub issue #2889); the CVSS 4.0 threat metric E:P confirms exploit code availability, though no CISA KEV listing indicates confirmed widespread active exploitation.
Information disclosure in zhayujie CowAgent up to version 2.1.0 exposes sensitive data to low-privileged authenticated remote attackers through the BrowserTool._do_navigate function in the Browser Tool component. Publicly available proof-of-concept exploit code exists via a GitHub issue report, though no patch has been released as the project maintainer has not yet responded to responsible disclosure. The CVSS 4.0 score of 2.1 and impact limited to low confidentiality exposure place this at the lower end of priority, tempered by the authentication requirement and niche product footprint.
Denial of service in zhayujie CowAgent up to version 2.1.7 allows a low-privileged remote attacker to crash or degrade availability by manipulating input to the Bash Tool component (agent/tools/bash/bash.py). The root cause is CWE-404 (Improper Resource Shutdown or Release), suggesting the Bash Tool fails to bound, drain, or release output buffers when executing shell commands - consistent with the public PoC title 'CowAgent_Bash_Output_Buffer_DoS_Report'. A proof-of-concept exploit is publicly available on GitHub, though no patch has been released and the vendor was unresponsive to disclosure.
Denial of service in zhayujie CowAgent up to version 2.1.3 allows a low-privileged remote attacker to crash or hang the agent service by sending a crafted input to the BrowserTool component in `agent/tools/browser/browser_tool.py`. The underlying cause (CWE-404) is improper resource shutdown or release - likely a browser subprocess or evaluation call that hangs indefinitely rather than timing out cleanly. A public proof-of-concept exists on GitHub; the vendor was unresponsive to disclosure, and no patch has been released.
Incorrect authorization in zhayujie CowAgent up to version 2.1.1 allows low-privilege authenticated remote attackers to bypass access controls in the Self-Evolution Review Agent component. The flaw resides in the _select_tools function of agent/evolution/executor.py (CWE-863), where authorization logic is implemented incorrectly, potentially permitting access to tools or agent capabilities outside the caller's intended permission scope. Publicly available exploit code exists (E:P in CVSS 4.0 vector), though active exploitation has not been confirmed by CISA KEV.
Server-side request forgery in zhayujie CowAgent up to version 2.1.1 allows low-privileged authenticated users to direct the server to issue arbitrary HTTP requests by supplying a crafted URL to the WebFetch.execute function, enabling internal network reconnaissance and cloud metadata credential theft. The WebFetch tool lacked any IP-range validation, leaving loopback, RFC1918, link-local, and cloud metadata endpoints (e.g., 169.254.169.254) fully reachable from the server. A public proof-of-concept exists (GitHub issue #2889); the CVSS 4.0 threat metric E:P confirms exploit code availability, though no CISA KEV listing indicates confirmed widespread active exploitation.
Information disclosure in zhayujie CowAgent up to version 2.1.0 exposes sensitive data to low-privileged authenticated remote attackers through the BrowserTool._do_navigate function in the Browser Tool component. Publicly available proof-of-concept exploit code exists via a GitHub issue report, though no patch has been released as the project maintainer has not yet responded to responsible disclosure. The CVSS 4.0 score of 2.1 and impact limited to low confidentiality exposure place this at the lower end of priority, tempered by the authentication requirement and niche product footprint.