CVE-2026-15628: zhayujie chatgpt-on-wechat CowAgent Vision Tool vision.py Vision._download_to_data_url server-side request forgery
A security flaw has been discovered in zhayujie chatgpt-on-wechat CowAgent up to 2.1.1. This issue affects the function Vision.downloadtodataurl of the file agent/tools/vision/vision.py of the component Vision Tool. Performing a manipulation of the argument image results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.1.2 is capable of addressing this issue. The patch is named e85290cddcbb5ffc9c235927f4c92e5b4c3ec264. The affected component should be upgraded.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
zhayujie chatgpt-on-wechat CowAgent Vision Tool vision.py Vision._download_to_data_urlto a version that resolves this vulnerability.Fixed in 2.1.2Patch e85290cddcbb5ffc9c235927f4c92e5b4c3ec264
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15628?
The severity of CVE-2026-15628 is classified as medium with a CVSS score of 6.3.
How do I fix CVE-2026-15628?
To fix CVE-2026-15628, update zhayujie chatgpt-on-wechat CowAgent to the latest version that addresses the server-side request forgery vulnerability.
What type of vulnerability is CVE-2026-15628?
CVE-2026-15628 is classified as a Server-Side Request Forgery (SSRF) vulnerability.
Who is affected by CVE-2026-15628?
Users of zhayujie chatgpt-on-wechat CowAgent versions up to 2.1.1 are affected by CVE-2026-15628.
What is the impact of CVE-2026-15628?
The impact of CVE-2026-15628 includes potential unauthorized access to internal resources through crafted image arguments.