Zhayujie
Monthly
Denial of service in zhayujie CowAgent up to version 2.1.7 allows a low-privileged remote attacker to crash or degrade availability by manipulating input to the Bash Tool component (agent/tools/bash/bash.py). The root cause is CWE-404 (Improper Resource Shutdown or Release), suggesting the Bash Tool fails to bound, drain, or release output buffers when executing shell commands - consistent with the public PoC title 'CowAgent_Bash_Output_Buffer_DoS_Report'. A proof-of-concept exploit is publicly available on GitHub, though no patch has been released and the vendor was unresponsive to disclosure.
Denial of service in zhayujie CowAgent up to version 2.1.3 allows a low-privileged remote attacker to crash or hang the agent service by sending a crafted input to the BrowserTool component in `agent/tools/browser/browser_tool.py`. The underlying cause (CWE-404) is improper resource shutdown or release - likely a browser subprocess or evaluation call that hangs indefinitely rather than timing out cleanly. A public proof-of-concept exists on GitHub; the vendor was unresponsive to disclosure, and no patch has been released.
Incorrect authorization in zhayujie CowAgent up to version 2.1.1 allows low-privilege authenticated remote attackers to bypass access controls in the Self-Evolution Review Agent component. The flaw resides in the _select_tools function of agent/evolution/executor.py (CWE-863), where authorization logic is implemented incorrectly, potentially permitting access to tools or agent capabilities outside the caller's intended permission scope. Publicly available exploit code exists (E:P in CVSS 4.0 vector), though active exploitation has not been confirmed by CISA KEV.
Server-side request forgery in zhayujie CowAgent up to version 2.1.1 allows low-privileged authenticated users to direct the server to issue arbitrary HTTP requests by supplying a crafted URL to the WebFetch.execute function, enabling internal network reconnaissance and cloud metadata credential theft. The WebFetch tool lacked any IP-range validation, leaving loopback, RFC1918, link-local, and cloud metadata endpoints (e.g., 169.254.169.254) fully reachable from the server. A public proof-of-concept exists (GitHub issue #2889); the CVSS 4.0 threat metric E:P confirms exploit code availability, though no CISA KEV listing indicates confirmed widespread active exploitation.
Server-side request forgery in zhayujie CowAgent's Vision Tool allows authenticated remote attackers to make the server issue arbitrary HTTP requests to internal network resources. The vulnerability exists in the Vision._download_to_data_url / _build_image_content function in agent/tools/vision/vision.py, where the image argument is passed to an HTTP fetch without URL validation, enabling access to private RFC1918 addresses, loopback interfaces, and other non-public infrastructure. A publicly available proof-of-concept exploit exists (GitHub issue #2878), and a vendor-released patch (version 2.1.2) is available.
Information disclosure in zhayujie CowAgent up to version 2.1.0 exposes sensitive data to low-privileged authenticated remote attackers through the BrowserTool._do_navigate function in the Browser Tool component. Publicly available proof-of-concept exploit code exists via a GitHub issue report, though no patch has been released as the project maintainer has not yet responded to responsible disclosure. The CVSS 4.0 score of 2.1 and impact limited to low confidentiality exposure place this at the lower end of priority, tempered by the authentication requirement and niche product footprint.
Missing authentication in CowAgent 2.1.0's /wx WeChat endpoint allows remote unauthenticated attackers to bypass server verification by supplying an empty or default wechatmp_token, causing the underlying HMAC signature check to silently degenerate into a predictable hash. The vendor confirms the flaw exists in verify_server() within channel/wechatmp/common.py, where no explicit non-empty token guard was enforced, making the endpoint fail open rather than closed. A public proof-of-concept exists (GitHub issue #2860), and the fix is available in version 2.1.1; no active exploitation has been confirmed by CISA KEV.
OS command injection in zhayujie chatgpt-on-wechat (also known as CowAgent) versions up to and including 2.0.8 allows remote attackers to execute arbitrary operating system commands by abusing the _get_safety_warning function within the Bash Tool component (agent/tools/bash/bash.py). Publicly available exploit code exists for this issue, increasing the likelihood of opportunistic abuse, though it is not currently listed in CISA KEV. The vendor has released version 2.0.9 (commit 16d9b449c9aa53ccee44144a762a2737d7ba4fc4) addressing the flaw.
Authentication bypass in zhayujie chatgpt-on-wechat CowAgent up to version 2.0.4 allows remote unauthenticated attackers to manipulate the Agent Mode Service component, resulting in missing authentication checks (CWE-306). Publicly available exploit code exists, and the vulnerability has been reported to the project without response. CVSS 6.9 reflects moderate confidentiality, integrity, and availability impact with network-accessible attack vector and no user interaction required.
Missing authentication in zhayujie chatgpt-on-wechat CowAgent 2.0.4 administrative HTTP endpoint allows remote attackers to bypass access controls and perform unauthorized administrative operations without credentials. Publicly available exploit code exists. EPSS risk not available; CVSS 7.3 reflects network-based attack requiring no privileges or user interaction. The vendor has not responded to the vulnerability disclosure (GitHub issue #2733) at time of analysis.
Path traversal in zhayujie chatgpt-on-wechat CowAgent up to version 2.0.4 allows unauthenticated remote attackers to read arbitrary files via the filename parameter in the API Memory Content Endpoint (agent/memory/service.py). The vulnerability has a publicly available exploit, carries a moderate CVSS score of 5.3 reflecting limited confidentiality impact, and has been patched by the vendor in version 2.0.5 with patch commit 174ee0cafc9e8e9d97a23c305418251485b8aa89.
Denial of service in zhayujie CowAgent up to version 2.1.7 allows a low-privileged remote attacker to crash or degrade availability by manipulating input to the Bash Tool component (agent/tools/bash/bash.py). The root cause is CWE-404 (Improper Resource Shutdown or Release), suggesting the Bash Tool fails to bound, drain, or release output buffers when executing shell commands - consistent with the public PoC title 'CowAgent_Bash_Output_Buffer_DoS_Report'. A proof-of-concept exploit is publicly available on GitHub, though no patch has been released and the vendor was unresponsive to disclosure.
Denial of service in zhayujie CowAgent up to version 2.1.3 allows a low-privileged remote attacker to crash or hang the agent service by sending a crafted input to the BrowserTool component in `agent/tools/browser/browser_tool.py`. The underlying cause (CWE-404) is improper resource shutdown or release - likely a browser subprocess or evaluation call that hangs indefinitely rather than timing out cleanly. A public proof-of-concept exists on GitHub; the vendor was unresponsive to disclosure, and no patch has been released.
Incorrect authorization in zhayujie CowAgent up to version 2.1.1 allows low-privilege authenticated remote attackers to bypass access controls in the Self-Evolution Review Agent component. The flaw resides in the _select_tools function of agent/evolution/executor.py (CWE-863), where authorization logic is implemented incorrectly, potentially permitting access to tools or agent capabilities outside the caller's intended permission scope. Publicly available exploit code exists (E:P in CVSS 4.0 vector), though active exploitation has not been confirmed by CISA KEV.
Server-side request forgery in zhayujie CowAgent up to version 2.1.1 allows low-privileged authenticated users to direct the server to issue arbitrary HTTP requests by supplying a crafted URL to the WebFetch.execute function, enabling internal network reconnaissance and cloud metadata credential theft. The WebFetch tool lacked any IP-range validation, leaving loopback, RFC1918, link-local, and cloud metadata endpoints (e.g., 169.254.169.254) fully reachable from the server. A public proof-of-concept exists (GitHub issue #2889); the CVSS 4.0 threat metric E:P confirms exploit code availability, though no CISA KEV listing indicates confirmed widespread active exploitation.
Server-side request forgery in zhayujie CowAgent's Vision Tool allows authenticated remote attackers to make the server issue arbitrary HTTP requests to internal network resources. The vulnerability exists in the Vision._download_to_data_url / _build_image_content function in agent/tools/vision/vision.py, where the image argument is passed to an HTTP fetch without URL validation, enabling access to private RFC1918 addresses, loopback interfaces, and other non-public infrastructure. A publicly available proof-of-concept exploit exists (GitHub issue #2878), and a vendor-released patch (version 2.1.2) is available.
Information disclosure in zhayujie CowAgent up to version 2.1.0 exposes sensitive data to low-privileged authenticated remote attackers through the BrowserTool._do_navigate function in the Browser Tool component. Publicly available proof-of-concept exploit code exists via a GitHub issue report, though no patch has been released as the project maintainer has not yet responded to responsible disclosure. The CVSS 4.0 score of 2.1 and impact limited to low confidentiality exposure place this at the lower end of priority, tempered by the authentication requirement and niche product footprint.
Missing authentication in CowAgent 2.1.0's /wx WeChat endpoint allows remote unauthenticated attackers to bypass server verification by supplying an empty or default wechatmp_token, causing the underlying HMAC signature check to silently degenerate into a predictable hash. The vendor confirms the flaw exists in verify_server() within channel/wechatmp/common.py, where no explicit non-empty token guard was enforced, making the endpoint fail open rather than closed. A public proof-of-concept exists (GitHub issue #2860), and the fix is available in version 2.1.1; no active exploitation has been confirmed by CISA KEV.
OS command injection in zhayujie chatgpt-on-wechat (also known as CowAgent) versions up to and including 2.0.8 allows remote attackers to execute arbitrary operating system commands by abusing the _get_safety_warning function within the Bash Tool component (agent/tools/bash/bash.py). Publicly available exploit code exists for this issue, increasing the likelihood of opportunistic abuse, though it is not currently listed in CISA KEV. The vendor has released version 2.0.9 (commit 16d9b449c9aa53ccee44144a762a2737d7ba4fc4) addressing the flaw.
Authentication bypass in zhayujie chatgpt-on-wechat CowAgent up to version 2.0.4 allows remote unauthenticated attackers to manipulate the Agent Mode Service component, resulting in missing authentication checks (CWE-306). Publicly available exploit code exists, and the vulnerability has been reported to the project without response. CVSS 6.9 reflects moderate confidentiality, integrity, and availability impact with network-accessible attack vector and no user interaction required.
Missing authentication in zhayujie chatgpt-on-wechat CowAgent 2.0.4 administrative HTTP endpoint allows remote attackers to bypass access controls and perform unauthorized administrative operations without credentials. Publicly available exploit code exists. EPSS risk not available; CVSS 7.3 reflects network-based attack requiring no privileges or user interaction. The vendor has not responded to the vulnerability disclosure (GitHub issue #2733) at time of analysis.
Path traversal in zhayujie chatgpt-on-wechat CowAgent up to version 2.0.4 allows unauthenticated remote attackers to read arbitrary files via the filename parameter in the API Memory Content Endpoint (agent/memory/service.py). The vulnerability has a publicly available exploit, carries a moderate CVSS score of 5.3 reflecting limited confidentiality impact, and has been patched by the vendor in version 2.0.5 with patch commit 174ee0cafc9e8e9d97a23c305418251485b8aa89.