This vulnerability in zhayujie CowAgent up to version 2.1.1 allows an attacker to perform server-side request forgery via manipulation of the url argument in the WebFetch.execute function located in agent/tools/web_fetch/web_fetch.py. The flaw enables remote attackers to induce the server to make HTTP requests to arbitrary URLs. The vendor responded promptly and released version 2.1.2 containing a patch identified by commit ea47f3097eed4f8295c4cb3d76ecb97e0f43d632 to mitigate this issue.

Successful exploitation of this SSRF vulnerability may allow an attacker to cause the server to make unintended HTTP requests, potentially leading to information disclosure or interaction with internal systems accessible only from the server. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, and limited privileges required.

Upgrade zhayujie CowAgent to version 2.1.2 or later, which contains the official fix for this SSRF vulnerability. The vendor has released this fixed version promptly after disclosure. No other mitigations are specifically indicated by the vendor advisory.