CVE-2026-120236Medium· 6.3▾ TwilightPoC availableA vulnerability was detected in ag-ui-protocol ag-ui up to 0.0.58. Affected by this vulnerability is an unknown functionality of the component Transport Decoder Handler. The manipulation results in improper input validation. The attack m…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 34.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
A vulnerability was detected in ag-ui-protocol ag-ui up to 0.0.58. Affected by this vulnerability is an unknown functionality of the component Transport Decoder Handler. The manipulation results in improper input validation. The attack may be launched remotely. The exploit is now public and may be used. The patch is identified as 660182b973a44b8eda5484b14b88eb9cc251edc4. It is suggested to upgrade the affected component.
ag-ui 0.0.1ag-ui 0.0.2ag-ui 0.0.3ag-ui 0.0.4ag-ui 0.0.5ag-ui 0.0.6ag-ui 0.0.7ag-ui 0.0.8ag-ui 0.0.9ag-ui 0.0.10ag-ui 0.0.11ag-ui 0.0.12ag-ui 0.0.13ag-ui 0.0.14ag-ui 0.0.15ag-ui 0.0.16ag-ui 0.0.17ag-ui 0.0.18ag-ui 0.0.19ag-ui 0.0.20ag-ui 0.0.21ag-ui 0.0.22ag-ui 0.0.23ag-ui 0.0.24ag-ui 0.0.25ag-ui 0.0.26ag-ui 0.0.27ag-ui 0.0.28ag-ui 0.0.29ag-ui 0.0.30ag-ui 0.0.31ag-ui 0.0.32ag-ui 0.0.33ag-ui 0.0.34ag-ui 0.0.35ag-ui 0.0.36ag-ui 0.0.37ag-ui 0.0.38ag-ui 0.0.39ag-ui 0.0.40ag-ui 0.0.41ag-ui 0.0.42ag-ui 0.0.43ag-ui 0.0.44ag-ui 0.0.45ag-ui 0.0.46ag-ui 0.0.47ag-ui 0.0.48ag-ui 0.0.49ag-ui 0.0.50Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-120235Medium· 4.3ag-ui-protocol ag-ui SSE Parser sse.ts parseSSEStream resource consumption
CVE-2026-120237Medium· 4.3ag-ui-protocol ag-ui Interrupt expiry index.ts isInterruptExpired resource consumption
CVE-2026-120233Medium· 5.3ag-ui-protocol ag-ui HttpAgent http.ts information disclosure
CVE-2026-120234Medium· 4.3ag-ui-protocol ag-ui HTTP Transport e.text resource consumption
CVE-2026-101099Medium· 4.3A vulnerability was detected in ag-ui-protocol ag-ui up to 2026-09-23
CVE-2026-101100Medium· 5.4A flaw has been found in ag-ui-protocol ag-ui up to 2026-09-07