The CowAgent Vision Tool contains a function, which accepts an image URL supplied by a client and causes the server to issue an HTTP or HTTPS request to that URL. This allows an attacker to craft a request that causes the server to reach internal or restricted resources, potentially exposing sensitive information or enabling further compromise. The weakness is identified as CWE‑918 and the CVSS base score of 6.9 reflects a moderate to high severity for remote exploitation.

All releases of CowAgent up to and including 2.1.1 are vulnerable. The issue is present in the Vision Tool component distributed through the zhayujie GitHub repository. Upgrading to version 2.1.2 addresses the SSRF vector by sanitising the image argument.

Exploitation requires remote access to an instance of CowAgent and the ability to submit a crafted image request. The EPSS score of < 1% indicates a very low probability of exploitation in the wild, and the vulnerability is not yet listed in the CISA KEV catalog. However, the public disclosure and ability to perform arbitrary internal network requests make it important to remediate without delay. The attack can be launched remotely, allowing an attacker to access internal services or steal data.