CVE-2026-16194

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-16194

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16194.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-16194

Published

2026-07-18T21:15:10.826Z

Modified

2026-07-22T05:29:48.518985443Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

zhayujie CowAgent web_fetch.py WebFetch.execute server-side request forgery

Details

A vulnerability was determined in zhayujie CowAgent up to 2.1.1. This affects the function WebFetch.execute of the file agent/tools/webfetch/webfetch.py. Executing a manipulation of the argument url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.1.2 is able to mitigate this issue. This patch is called ea47f3097eed4f8295c4cb3d76ecb97e0f43d632. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Database specific

{
    "cwe_ids": [
        "CWE-918"
    ],
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16194.json"
}

References

Affected packages

Git / github.com/zhayujie/cowagent

Affected ranges

Type

GIT

Repo

https://github.com/zhayujie/cowagent

Events

Introduced

feaa9076b0d5eb60cab5ada6aec20f09d4d774fb

Fixed

ea47f3097eed4f8295c4cb3d76ecb97e0f43d632

Fixed

01373465b0603bf9a80ab5f8a45d34b9c310366e

Database specific

{
    "extracted_events": [
        {
            "introduced": "2.1.0"
        },
        {
            "last_affected": "2.1.0"
        },
        {
            "introduced": "2.1.1"
        },
        {
            "last_affected": "2.1.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2.*

2.1.0

2.1.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16194.json"