CVE-2026-15628: Server-Side Request Forgery in zhayujie chatgpt-on-wechat CowAgent
A security flaw has been discovered in zhayujie chatgpt-on-wechat CowAgent up to 2.1.1. This issue affects the function Vision._download_to_data_url of the file agent/tools/vision/vision.py of the component Vision Tool. Performing a manipulation of the argument image results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.1.2 is capable of addressing this issue. The patch is named e85290cddcbb5ffc9c235927f4c92e5b4c3ec264. The affected component should be upgraded.
AI Analysis
Technical Summary
This vulnerability exists in the Vision._download_to_data_url function within the agent/tools/vision/vision.py file of the chatgpt-on-wechat CowAgent product by zhayujie. By manipulating the image argument, an attacker can cause the server to make unauthorized requests, constituting a server-side request forgery. The issue affects versions 2.1.0 and 2.1.1 and can be exploited remotely without user interaction. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity). The vendor has released a patch in version 2.1.2, identified by commit e85290cddcbb5ffc9c235927f4c92e5b4c3ec264, which mitigates the vulnerability.
Potential Impact
Successful exploitation of this vulnerability could allow an attacker to make the server perform unauthorized requests to internal or external systems, potentially leading to information disclosure or interaction with internal services not otherwise accessible. The CVSS score of 5.3 reflects a medium severity impact with network attack vector and low complexity. There is no indication of privilege escalation or user interaction required.
Mitigation Recommendations
A patch is available in version 2.1.2 of chatgpt-on-wechat CowAgent that addresses this vulnerability. Users should upgrade affected installations from versions 2.1.0 and 2.1.1 to 2.1.2. Since this is a cloud service, the vendor manages remediation for the hosted environment; users should verify with the vendor that their cloud instances have been updated accordingly.
CVE-2026-15628: Server-Side Request Forgery in zhayujie chatgpt-on-wechat CowAgent
Description
A security flaw has been discovered in zhayujie chatgpt-on-wechat CowAgent up to 2.1.1. This issue affects the function Vision._download_to_data_url of the file agent/tools/vision/vision.py of the component Vision Tool. Performing a manipulation of the argument image results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.1.2 is capable of addressing this issue. The patch is named e85290cddcbb5ffc9c235927f4c92e5b4c3ec264. The affected component should be upgraded.
CVSS v4.0
Score 5.3medium
Affected software
pkg:pypi/chatgpt-on-wechat-cowagentcpe:2.3:a:zhayujie:chatgpt-on-wechat_cowagent:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability exists in the Vision._download_to_data_url function within the agent/tools/vision/vision.py file of the chatgpt-on-wechat CowAgent product by zhayujie. By manipulating the image argument, an attacker can cause the server to make unauthorized requests, constituting a server-side request forgery. The issue affects versions 2.1.0 and 2.1.1 and can be exploited remotely without user interaction. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity). The vendor has released a patch in version 2.1.2, identified by commit e85290cddcbb5ffc9c235927f4c92e5b4c3ec264, which mitigates the vulnerability.
Potential Impact
Successful exploitation of this vulnerability could allow an attacker to make the server perform unauthorized requests to internal or external systems, potentially leading to information disclosure or interaction with internal services not otherwise accessible. The CVSS score of 5.3 reflects a medium severity impact with network attack vector and low complexity. There is no indication of privilege escalation or user interaction required.
Mitigation Recommendations
A patch is available in version 2.1.2 of chatgpt-on-wechat CowAgent that addresses this vulnerability. Users should upgrade affected installations from versions 2.1.0 and 2.1.1 to 2.1.2. Since this is a cloud service, the vendor manages remediation for the hosted environment; users should verify with the vendor that their cloud instances have been updated accordingly.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-07-13T17:28:11.050Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
- Is Cloud Service
- true
Threat ID: 6a55adf468715ace439f3499
Added to database: 07/14/2026, 03:33:08 UTC
Last enriched: 07/14/2026, 03:47:29 UTC
Last updated: 08/15/2026, 12:41:07 UTC
Views: 78
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.