CVE-2026-84427
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A vulnerability was determined in zhayujie CowAgent up to 2.1.7. Affected is an unknown function of the file agent/tools/bash/bash.py of the component Bash Tool. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Risk Assessment
The risk includes remote denial of service, potentially disrupting system or application operations.
Recommendation
It is recommended to restrict access to the Bash Tool and monitor the system for unusual activities. Also consider updating if available.
Other vulnerabilities in CowAgent
See all- CVE-2026-84425Medium
A vulnerability was found in zhayujie CowAgent up to 2.1.3. This impacts the function BrowserTool of the file agent/tools/browser/browser_tool.py of the component Browser Tool. Performing a manipulation results in denial of service. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CVE-2026-18992Medium
A vulnerability was detected in zhayujie CowAgent up to 2.1.1. It affects the function _select_tools in the file agent/evolution/executor.py of the Self-Evolution Review Agent component. Manipulation leads to incorrect authorization. The attack can be performed remotely, and the exploit is public.
- CVE-2026-16194Medium
A server-side request forgery (SSRF) vulnerability was found in zhayujie CowAgent up to version 2.1.1 in the WebFetch.execute function of agent/tools/web_fetch/web_fetch.py. The attack can be performed remotely by manipulating the url argument, and the exploit has been publicly disclosed.
- CVE-2026-15332Medium
A security flaw in zhayujie CowAgent up to 2.1.0 exists in channel/channel.py of the Message Endpoint component. Missing authorization in an unknown function allows remote unauthenticated attacks. The exploit is public and may be used in attacks.
- CVE-2026-15331Medium
A path traversal vulnerability was found in zhayujie CowAgent up to version 2.1.0 in the _add_url/_add_package function of agent/skills/service.py. Manipulation of the Name argument allows remote attack.
- CVE-2026-15329Medium
A vulnerability in zhayujie CowAgent up to version 2.1.0 affects the BrowserTool._do_navigate function in agent/tools/browser/browser_tool.py. Input manipulation leads to information disclosure. The attack can be performed remotely and the exploit has been made public.
Original NVD description (English source)
A vulnerability was determined in zhayujie CowAgent up to 2.1.7. Affected is an unknown function of the file agent/tools/bash/bash.py of the component Bash Tool. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS