Executive brief
zhayujie CowAgent (chatgpt-on-wechat) is an AI agent framework. A security vulnerability in its Vision Tool allows remote attackers to force the server to make unauthorized requests to internal network resources. This could lead to the exposure of sensitive internal data, such as cloud metadata or private network services, which are normally not accessible from the internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the `Vision._download_to_data_url` function within `agent/tools/vision/vision.py`. The application fails to validate user-supplied image URLs before passing them to `requests.get()`, allowing an attacker to target loopback addresses, RFC1918 private networks, and cloud metadata endpoints (e.g., 169.254.169.254). While the vulnerability is exploitable remotely, it typically requires the attacker to have the ability to provide input to the agent (represented by the PR:L CVSS metric). Version 2.1.2 introduces a `_validate_url_safe()` function that resolves hostnames and rejects private or reserved IP ranges to mitigate this issue.
Affected products
- zhayujie CowAgent (chatgpt-on-wechat) <= 2.1.1
Timeline
- 2026-06-11: patched: Fix committed in e85290cddcbb5ffc9c235927f4c92e5b4c3ec264
- 2026-06-18: advisory: Release 2.1.2 published
- 2026-07-14: disclosed: CVE-2026-15628 published to NVD
References
- https://github.com/zhayujie/CowAgent/commit/e85290cddcbb5ffc9c235927f4c92e5b4c3ec264
- https://github.com/zhayujie/CowAgent/issues/2878
- https://github.com/zhayujie/CowAgent/pull/2886
- https://github.com/zhayujie/CowAgent/releases/tag/2.1.2
- https://vuldb.com/cve/CVE-2026-15628
- https://vuldb.com/submit/855849
- https://vuldb.com/vuln/378130