Executive brief
CowAgent, an AI assistant and agent framework, contains a vulnerability in its skill installation process. An attacker with authenticated access to the management interface can provide a specially crafted skill name to save files outside of the intended directory. This could allow an attacker to overwrite system files or disrupt the application's operations, potentially leading to a loss of system integrity or service availability.
Technical details
A path traversal vulnerability exists in CowAgent versions up to 2.1.0 within the Skill Installation Handler component. The root cause is the lack of sanitization of the 'Name' argument in the _add_url and _add_package functions located in agent/skills/service.py. An authenticated remote attacker can exploit this by supplying a name containing traversal sequences (e.g., '../'), allowing them to write extracted skill content to arbitrary locations outside the designated 'skills/' root directory. This can result in unauthorized file creation or overwriting of existing files. The issue is resolved in version 2.1.2 by implementing a path validation guard.
Affected products
- zhayujie CowAgent up to 2.1.0
Timeline
- 2026-06-11: patched: Fix committed in e85290cddcbb5ffc9c235927f4c92e5b4c3ec264
- 2026-07-10: disclosed: Vulnerability published via VulDB and NVD
References
- https://github.com/zhayujie/CowAgent/
- https://github.com/zhayujie/CowAgent/commit/e85290cddcbb5ffc9c235927f4c92e5b4c3ec264
- https://github.com/zhayujie/CowAgent/issues/2873
- https://github.com/zhayujie/CowAgent/pull/2886
- https://github.com/zhayujie/CowAgent/releases/tag/2.1.2
- https://vuldb.com/cve/CVE-2026-15331
- https://vuldb.com/submit/853104