Answer in brief
CVE-2026-15330 records a High severity (CVSS 7.3) vulnerability in zhayujie CowAgent Vision Tool vision.py _download_to_data_url server-side request forgery. The current sources do not mark it as known exploited. The current feed maps zhayujie/CowAgent (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps zhayujie/CowAgent (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| zhayujie/CowAgentgeneric | 2.1.0 || 2.1.1 | Not reported |
Published upstream
Jul 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 10, 2026
A vulnerability was determined in zhayujie CowAgent up to 2.1.1. Impacted is the function _build_image_content/_download_to_data_url of the file agent/tools/vision/vision.py of the component Vision Tool. Executing a manipulation of the argument image can lead to server-side request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.1.2 is recommended to address this issue. This patch is called e85290cddcbb5ffc9c235927f4c92e5b4c3ec264. Upgrading the affected component is advised.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-15330 records a High severity (CVSS 7.3) vulnerability in zhayujie CowAgent Vision Tool vision.py _download_to_data_url server-side request forgery. The current sources do not mark it as known exploited. The current feed maps zhayujie/CowAgent (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps zhayujie/CowAgent (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| zhayujie/CowAgentgeneric | 2.1.0 || 2.1.1 | Not reported |
Published upstream
Jul 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 10, 2026
A vulnerability was determined in zhayujie CowAgent up to 2.1.1. Impacted is the function _build_image_content/_download_to_data_url of the file agent/tools/vision/vision.py of the component Vision Tool. Executing a manipulation of the argument image can lead to server-side request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.1.2 is recommended to address this issue. This patch is called e85290cddcbb5ffc9c235927f4c92e5b4c3ec264. Upgrading the affected component is advised.
Quoted source text, attributed separately from HOL analysis.