Server-Side Request Forgery in zhayujie ChatGPT-on-WeChat

Executive Summary

CVE-2026-15628 is a Server-Side Request Forgery (SSRF) vulnerability in the zhayujie chatgpt-on-wechat CowAgent software, specifically affecting versions up to 2.1.1. The vulnerability exists in the Vision._download_to_data_url function within the agent/tools/vision/vision.py file.

The issue occurs when the software processes an attacker-controlled image URL without proper validation. The function performs a direct HTTP request using requests.get() without checking if the URL points to internal, loopback, or private network addresses. This allows an attacker to manipulate the image argument to force the server to make arbitrary HTTP requests to internal services or restricted endpoints.

• The vulnerability can be exploited remotely by an attacker.
• The attack is triggered when a user invokes the vision tool and at least one vision-capable provider is configured.
• Exploitation could enable probing of internal services, metadata endpoints, or other restricted resources.

The vulnerability has been patched in version 2.1.2, with the fix introduced in commit e85290cddcbb5ffc9c235927f4c92e5b4c3ec264. The patch adds URL validation to block requests targeting private IP ranges, loopback addresses, and other reserved ranges.

Useful 0 Not Useful 0

Detection Guidance

To detect the presence of CVE-2026-15628 on your system or network, you can check for the following indicators:

• Verify the version of zhayujie chatgpt-on-wechat CowAgent installed. The vulnerability affects versions up to 2.1.1. You can check the version by inspecting the project files or running the application with version flags if supported.
• Inspect the `agent/tools/vision/vision.py` file for the vulnerable `_download_to_data_url` function. The absence of URL validation (e.g., checks for private, loopback, or reserved IP ranges) indicates the vulnerability is present.
• Monitor network traffic for unexpected HTTP requests originating from the host running the CowAgent. Use network monitoring tools like Wireshark or tcpdump to capture traffic to/from the host. Look for requests to internal or loopback addresses (e.g., 127.0.0.1, 192.168.x.x, 10.x.x.x, 169.254.169.254) that may indicate SSRF exploitation.

Example commands for network monitoring:

• Using tcpdump to capture traffic on port 80 or 443: `sudo tcpdump -i any port 80 or port 443 -w capture.pcap`
• Filter for private or loopback IP ranges: `sudo tcpdump -i any 'dst net 10.0.0.0/8 or dst net 172.16.0.0/12 or dst net 192.168.0.0/16 or dst net 127.0.0.0/8 or dst host 169.254.169.254'`
• Check for installed version via package manager or file inspection. For example, if the project is installed in a directory, navigate to it and check the version in the metadata or configuration files.

Useful 0 Not Useful 0

Impact Analysis

If you are using an affected version of zhayujie chatgpt-on-wechat CowAgent (up to 2.1.1), this vulnerability could have several impacts:

• An attacker could force your system to make unauthorized HTTP requests to internal or restricted services, potentially exposing sensitive information.
• The attacker could probe internal networks, including cloud metadata endpoints (e.g., 169.254.169.254), which may contain credentials or configuration details.
• The vulnerability could be used to access local admin interfaces or other internal services that are not intended to be publicly accessible.
• Exploitation could lead to information disclosure, such as internal IP addresses, service configurations, or other sensitive data.

The impact is rated as Medium severity, with potential for low confidentiality and integrity impacts, as well as no availability impact, according to the CVSS v3.1 score of 6.3.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could affect compliance with several common standards and regulations, depending on the context in which the affected software is used:

• GDPR (General Data Protection Regulation): If the vulnerability leads to unauthorized access to personal data of EU citizens, it could result in a violation of GDPR. The regulation requires organizations to implement appropriate technical measures to protect personal data from unauthorized access or disclosure. A breach involving personal data could trigger reporting obligations and potential fines.
• HIPAA (Health Insurance Portability and Accountability Act): If the affected software is used in a healthcare context and the vulnerability exposes protected health information (PHI), it could lead to a HIPAA violation. HIPAA requires covered entities to protect the confidentiality, integrity, and availability of PHI. Unauthorized access to PHI could result in penalties and corrective action plans.
• Other standards like ISO 27001 or NIST frameworks: The vulnerability represents a failure to implement adequate security controls for protecting against SSRF attacks. This could be seen as a gap in an organization's information security management system (ISMS) or risk management framework, potentially leading to non-compliance with these standards.

To maintain compliance, organizations should ensure they upgrade to the patched version of the software (2.1.2 or later) and implement additional security controls, such as network segmentation, to limit the potential impact of such vulnerabilities.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate CVE-2026-15628, follow these immediate steps:

• Upgrade the zhayujie chatgpt-on-wechat CowAgent to version 2.1.2 or later. This version includes the patch for the SSRF vulnerability in the Vision tool. The patch adds URL validation to block requests to private, loopback, or reserved IP ranges.
• If upgrading is not immediately possible, apply the patch manually by incorporating the changes from commit `e85290cddcbb5ffc9c235927f4c92e5b4c3ec264`. Specifically, add the `_validate_url_safe()` function to `agent/tools/vision/vision.py` to validate URLs before making HTTP requests.
• Restrict network access for the host running the CowAgent. Use firewall rules to block outbound HTTP/HTTPS requests to internal or loopback IP ranges unless explicitly required for legitimate operations.
• Disable the Vision tool if it is not required for your use case. This can be done by removing or commenting out the relevant code or configuration that invokes the Vision tool.
• Monitor logs for suspicious activity, such as requests to internal or metadata endpoints (e.g., 169.254.169.254). Set up alerts for any unusual outbound traffic patterns.
• Review and validate all user-provided URLs before processing them in the Vision tool. Ensure that only trusted and externally accessible URLs are allowed.

Useful 0 Not Useful 0