CVE-2026-108769 Details

A denial-of-service vulnerability has been identified in zhayujie CowAgent versions through 2.2.0. The issue resides in the Markdown rendering component, specifically within the file Markdown.tsx. This vulnerability allows for remote exploitation, leading to excessive resource consumption and potential UI unresponsiveness. The problem arises because ordinary assistant responses are streamed without a proper content rendering cap, causing the application to repeatedly reprocess and render large Markdown inputs. This flaw can be exploited by generating substantial Markdown content during normal chat interactions, which the application then inefficiently handles, causing CPU spikes and freezing the user interface.

To address this vulnerability, it is recommended to implement a main-content streaming render budget and avoid full Markdown reparsing on each streamed delta. Suggested measures include establishing a render cap for regular answers, appending text through a text node during streaming, and deferring complete Markdown rendering until the end of the message. Additionally, for oversized answers, a truncation notice could be provided along with an option to download or copy the full text.