CVE-2026-15628

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-15628

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15628.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-15628

Published

2026-07-14T03:00:11.144Z

Modified

2026-07-16T03:48:17.179704610Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

zhayujie chatgpt-on-wechat CowAgent Vision Tool vision.py Vision._download_to_data_url server-side request forgery

Details

A security flaw has been discovered in zhayujie chatgpt-on-wechat CowAgent up to 2.1.1. This issue affects the function Vision.downloadtodataurl of the file agent/tools/vision/vision.py of the component Vision Tool. Performing a manipulation of the argument image results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.1.2 is capable of addressing this issue. The patch is named e85290cddcbb5ffc9c235927f4c92e5b4c3ec264. The affected component should be upgraded.

Database specific

{
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15628.json",
    "cna_assigner": "VulDB"
}

References

Affected packages

Git / github.com/zhayujie/cowagent

Affected ranges

Type

GIT

Repo

https://github.com/zhayujie/cowagent

Events

Introduced

feaa9076b0d5eb60cab5ada6aec20f09d4d774fb

Fixed

e85290cddcbb5ffc9c235927f4c92e5b4c3ec264

Fixed

01373465b0603bf9a80ab5f8a45d34b9c310366e

Database specific

{
    "extracted_events": [
        {
            "introduced": "2.1.0"
        },
        {
            "last_affected": "2.1.0"
        },
        {
            "introduced": "2.1.1"
        },
        {
            "last_affected": "2.1.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2.*

2.1.0

2.1.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15628.json"