CVE-2026-15628: zhayujie CowAgent SSRF in Vision Tool

CVE-2026-15628 · Severity: medium · CVSS 6.3 · Published 2026-07-14

zhayujie CowAgent (chatgpt-on-wechat) is an AI agent framework. A security vulnerability in its Vision Tool allows remote attackers to force the server to make unauthorized requests to internal network resources. This could lead to the exposure of sensitive internal data, such as cloud metadata or private network services, which are normally not accessible from the internet.

Technologies: Zhayujie Chatgpt-On-Wechat. Vendors: Zhayujie.

Quick answers

Is CVE-2026-15628 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-15628 being exploited in the wild.
How severe is CVE-2026-15628?
Medium severity, with a CVSS score of 6.3, published 14 July 2026.
Which products and versions are affected?
Zhayujie Chatgpt-On-Wechat <= 2.1.1.
Is there a fix for CVE-2026-15628?
A patch was published on 2026-06-11: Fix committed in e85290cddcbb5ffc9c235927f4c92e5b4c3ec264 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-15628 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-15628?
Check whether you run Zhayujie Chatgpt-On-Wechat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the `Vision._download_to_data_url` function within `agent/tools/vision/vision.py`. The application fails to validate user-supplied image URLs before passing them to `requests.get()`, allowing an attacker to target loopback addresses, RFC1918 private networks, and cloud metadata endpoints (e.g., 169.254.169.254). While the vulnerability is exploitable remotely, it typically requires the attacker to have the ability to provide input to the agent (represented by the PR:L CVSS metric). Version 2.1.2 introduces a `_validate_url_safe()` function that resolves hostnames and rejects private or reserved IP ranges to mitigate this issue.

Affected products

  • zhayujie CowAgent (chatgpt-on-wechat) <= 2.1.1

Timeline

  • 2026-06-11: patched: Fix committed in e85290cddcbb5ffc9c235927f4c92e5b4c3ec264
  • 2026-06-18: advisory: Release 2.1.2 published
  • 2026-07-14: disclosed: CVE-2026-15628 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.