Quick answers
- Is CVE-2026-84427 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-84427 being exploited in the wild.
- How severe is CVE-2026-84427?
- Medium severity, with a CVSS score of 4.3, published 2 September 2026.
- Which products and versions are affected?
- Zhayujie CowAgent up to 2.1.7.
- Is there a fix for CVE-2026-84427?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-84427 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-84427?
- Check whether you run Zhayujie CowAgent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a denial-of-service flaw in the Bash tool component (agent/tools/bash/bash.py) where command output is fully buffered in memory before truncation is applied. An attacker can perform prompt injection to cause the agent to invoke the Bash tool with a command that emits very large stdout or stderr output. The tool accumulates all output chunks in byte buffers, decodes the full output, and writes it to a temporary file without size limits, leading to memory exhaustion and process unavailability. The attack is remotely exploitable via crafted task instructions and does not require authentication. Vendor contact was attempted early in disclosure but was unanswered.
Affected products
- zhayujie CowAgent up to 2.1.7
Timeline
- 2026-09-02: disclosed