CVE-2026-15329
zhayujie CowAgent Browser Tool browser_tool.py BrowserTool._do_navigate information disclosure
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jul 10, 2026
- Updated
- Jul 14, 2026
- Reserved
- Jul 9, 2026
Description
A vulnerability was found in zhayujie CowAgent up to 2.1.0. This issue affects the function BrowserTool._do_navigate of the file agent/tools/browser/browser_tool.py of the component Browser Tool. Performing a manipulation results in information disclosure. The attack can be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C | VulDB |
| 3.0 | 4.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C | VulDB |
| 2.0 | 4.0 Medium | AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
CowAgentzhayujie |
|
References
- VDB-377272 | zhayujie CowAgent Browser Tool browser_tool.py BrowserTool._do_navigate information disclosurevdb-entrytechnical-description
- VDB-377272 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-15329 | CVE Analysis and Reportthird-party-advisory
- Submit #853098 | zhayujie CowAgent <= 2.1.0 Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)third-party-advisory
- https://github.com/zhayujie/CowAgent/issues/2871exploitissue-tracking
- https://github.com/zhayujie/CowAgent/issues/2871#issuecomment-4922534422issue-tracking
- https://github.com/zhayujie/CowAgent/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.