These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A denial of service vulnerability was discovered in zhayujie CowAgent up to 2.2.0 in the Markdown Rendering component. The issue is triggered by a specific manipulation and can be exploited remotely. The vendor did not respond to the disclosure. This vulnerability affects the Markdown Rendering component of zhayujie CowAgent, specifically within the file Markdown.tsx. A denial of service can be triggered [truncated]
A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of the component Streaming Tool-Call Argument Handler. The manipulation leads to allocation of resources. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
A weakness has been identified in zhayujie CowAgent up to 2.1.6. The affected element is the function read of the file /upload of the component Web Console. This manipulation causes denial of service. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an unknown function of the component Media Download Handler. Such manipulation leads to uncontrolled memory allocation. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.2.0 is sufficient to resolve this issue.
A denial-of-service vulnerability exists in zhayujie CowAgent versions up to 2.1.7 in the web console, specifically in the web_channel.py file. The vulnerability is triggered by manipulating the session_id argument, and it can be exploited remotely. The vendor has partially mitigated this issue in version 2.1.7 with a 512MB body cap. Defenders should verify exposure of CowAgent web console instances, espe [truncated]
A vulnerability was detected in zhayujie CowAgent up to 2.1.1. This vulnerability affects the function _select_tools of the file agent/evolution/executor.py of the component Self-Evolution Review Agent. Performing a manipulation results in incorrect authorization. The attack is possible to be carried out remotely. The vulnerability class is related to incorrect authorization. Likely operational impact inc [truncated]
A server-side request forgery vulnerability was found in CowAgent up to 2.1.1. The vulnerability affects the WebFetch.execute function in the web_fetch.py file. The vulnerability can be exploited remotely and has been publicly disclosed. Upgrading to version 2.1.2 mitigates this issue. This vulnerability has a CVSS score of 2.1 and a severity of LOW. The attack may be performed from remote.
A security flaw has been discovered in zhayujie chatgpt-on-wechat CowAgent up to 2.1.1, affecting the function Vision._download_to_data_url. This issue results in server-side request forgery, allowing remote attackers to initiate an attack. The exploit has been released to the public, and upgrading to version 2.1.2 or applying the patch e85290cddcbb5ffc9c235927f4c92e5b4c3ec264 is necessary.
A security flaw has been discovered in zhayujie CowAgent up to 2.1.0. The impacted element is an unknown function of the file channel/channel.py of the component Message Endpoint. The manipulation results in missing authorization. The attack may be launched remotely. Users of CowAgent up to version 2.1.0 should assess the vulnerability and apply patches or mitigations as available. The vulnerability allow [truncated]
A vulnerability was determined in zhayujie CowAgent up to 2.1.1, impacting the Vision Tool component. The functions _build_image_content and _download_to_data_url in the file agent/tools/vision/vision.py are vulnerable to server-side request forgery. The attack can be launched remotely. Upgrading to version 2.1.2 or applying the patch e85290cddcbb5ffc9c235927f4c92e5b4c3ec264 is recommended.
CVE-2026-15329 is an information disclosure vulnerability in CowAgent's Browser Tool. The issue affects the BrowserTool._do_navigate function in agent/tools/browser/browser_tool.py. The vulnerability allows remote attackers to disclose sensitive information. The exploit has been made public, and the project has been informed but has not responded yet. This vulnerability has a low severity and requires lim [truncated]
A command injection vulnerability exists in the Bash Tool component of zhayujie chatgpt-on-wechat (also referenced as CowAgent) versions up to and including 2.0.8. The weakness is located in the `_get_safety_warning` function within `agent/tools/bash/bash.py`. An attacker can exploit this flaw remotely through crafted input manipulation to achieve operating system command injection. The vulnerability has [truncated]