Executive brief
CowAgent, an AI assistant framework, contains a vulnerability in its browser tool that allows users to access sensitive local files on the server. By providing a specially crafted file path instead of a web address, an attacker can trick the assistant into reading and displaying the contents of private system files. This could lead to the exposure of configuration data, credentials, or other confidential information stored on the host machine.
Technical details
A Local File Disclosure (LFD) vulnerability exists in CowAgent up to version 2.1.0 within the Browser Tool component. The root cause is the lack of a URL scheme allowlist in the `BrowserTool._do_navigate` function in `agent/tools/browser/browser_tool.py`. The application intentionally preserves non-network schemes like `file://`, `about:`, and `data:`, passing them directly to the Playwright `page.goto()` method. An authenticated remote attacker can provide a `file://` URL to the `navigate` action, causing the underlying Chromium instance to load local system files. The tool then automatically snapshots the page content and returns the file's text to the attacker. As of the advisory date, the project has not responded to the issue report.
Affected products
- zhayujie CowAgent up to 2.1.0
Timeline
- 2026-06-09: disclosed: Issue reported on GitHub repository
- 2026-07-10: advisory: CVE published by VulDB/NVD