CVE-2026-15330

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-15330
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15330.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-15330
Published
2026-07-10T04:00:10Z
Modified
2026-08-12T03:51:18Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
zhayujie CowAgent Vision Tool vision.py _download_to_data_url server-side request forgery
Details

A vulnerability was determined in zhayujie CowAgent up to 2.1.1. Impacted is the function _build_image_content/_download_to_data_url of the file agent/tools/vision/vision.py of the component Vision Tool. Executing a manipulation of the argument image can lead to server-side request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.1.2 is recommended to address this issue. This patch is called e85290cddcbb5ffc9c235927f4c92e5b4c3ec264. Upgrading the affected component is advised.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15330.json"
}
References

Affected packages

Git / github.com/zhayujie/cowagent

Affected ranges

Type
GIT
Repo
https://github.com/zhayujie/cowagent
Events
Introduced
feaa9076b0d5eb60cab5ada6aec20f09d4d774fb
Fixed
e85290cddcbb5ffc9c235927f4c92e5b4c3ec264
Fixed
01373465b0603bf9a80ab5f8a45d34b9c310366e
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "2.1.0"
        },
        {
            "last_affected": "2.1.0"
        },
        {
            "introduced": "2.1.1"
        },
        {
            "last_affected": "2.1.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.1.0
2.1.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15330.json"