Description

A vulnerability was found in zhayujie CowAgent up to 2.1.3. This impacts the function BrowserTool of the file agent/tools/browser/browser_tool.py of the component Browser Tool. Performing a manipulation results in denial of service. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-02T01:17:23.710Z",
  "pubdate": "2026-09-02T01:17:23.710Z",
  "executiveSummary": "A remote denial-of-service (DoS) vulnerability has been identified in the BrowserTool component of CowAgent, affecting versions up to 2.1.3.\nThe vulnerability resides within the agent/tools/browser/browser_tool.py file, where improper input handling allows for service disruption.\nSuccessful exploitation allows a remote, unauthenticated attacker to crash the application or induce a state of service unavailability.\nThe vulnerability is currently public, increasing the risk of active exploitation. The vendor has remained unresponsive to disclosure attempts, leaving systems running these versions without a direct vendor-provided patch.\nThis flaw poses a significant risk to the operational availability of the CowAgent framework, requiring immediate defensive intervention by administrators.",
  "technicalDetails": "The vulnerability is localized to the BrowserTool function within the file agent/tools/browser/browser_tool.py. The root cause pertains to an improper validation of input parameters processed by the BrowserTool module during its interaction with the underlying browser automation engine.\nThe attack flow involves an attacker supplying specifically crafted input to the BrowserTool interface. Because the component does not adequately bound or sanitize these inputs before passing them to the browser execution context, the application enters an unrecoverable state or consumes system resources until failure occurs.\nAs the exploit is initiated remotely, the attacker does not require local access to the host server. The BrowserTool component essentially acts as an execution bridge that, when manipulated, triggers a crash or resource exhaustion, effectively terminating the agent's functionality.\nSince CowAgent is designed to operate as an automated agent, the ability for a remote party to trigger a Denial of Service implies that the service can be forced into an offline state at any time by an unauthorized actor. The lack of input sanitization in the affected Python file allows the exploitation of the internal logic to disrupt normal operations without requiring higher-level privileges or authentication.\nDetailed analysis suggests that the lack of error handling in agent/tools/browser/browser_tool.py exacerbates the impact; when the browser automation engine encounters the malformed input, the resulting exception is not gracefully handled by the agent's control loop, leading to the collapse of the entire Agent service.\nPost-exploitation, the service remains unavailable until a manual restart of the process is performed, providing an attacker with a vector for persistent service disruption."
}