CVE-2026-108769
4.3MediumPublished 11 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-404
Impact
Authenticated remote attackers can trigger a denial of service by sending crafted input to the markdown rendering engine. Exploitation requires network access and low-privilege authentication, and public exploit code is available.
Root cause
Improper resource handling in the Markdown.tsx component causes a crash or hang during stream rendering.
Affected systems
zhayujie CowAgent up to 2.2.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Fix & remediation
No official patched version is available; restrict network access or disable Markdown stream rendering in affected deployments until a vendor patch is released.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A security flaw has been discovered in zhayujie CowAgent up to 2.2.0. This affects an unknown part of the file Markdown.tsx of the component Markdown Rendering. The manipulation results in denial of service. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.