CVE-2026-15628 zhayujie CVE debrief

Who should care

Users of zhayujie chatgpt-on-wechat CowAgent up to 2.1.1 should be aware of this server-side request forgery vulnerability and take steps to upgrade to version 2.1.2. Affected operators, platforms, vulnerability-management, and security teams should review official advisories and plan vendor-supported updates or mitigations.

Technical summary

The vulnerability is caused by a manipulation of the argument image in the function Vision._download_to_data_url of the file agent/tools/vision/vision.py. This results in server-side request forgery, allowing remote attackers to initiate an attack. The issue has been addressed in version 2.1.2 with patch e85290cddcbb5ffc9c235927f4c92e5b4c3ec264. Affected product context includes zhayujie chatgpt-on-wechat CowAgent up to 2.1.1. Defensive impact involves upgrading to version 2.1.2 or applying the patch.

Defensive priority

Low

Recommended defensive actions

• Upgrade to version 2.1.2
• Apply patch e85290cddcbb5ffc9c235927f4c92e5b4c3ec264
• Monitor for remote attacks
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The vulnerability has been publicly disclosed and an exploit has been released. Users should take steps to upgrade to version 2.1.2 or apply the patch. Evidence is limited, and defenders should verify affected product deployments and review official advisories for validation. Affected scope, severity, and vendor guidance should be confirmed. Compensating controls and monitoring should be reviewed for exposed systems.

Official resources