---
id: CVE-2026-120237
title: >-
  ag-ui-protocol ag-ui Interrupt expiry index.ts isInterruptExpired resource
  consumption
summary: >-
  A flaw has been found in ag-ui-protocol ag-ui up to 0.0.58. Affected by this
  issue is the function isInterruptExpired of the file
  sdks/typescript/packages/client/src/interrupts/index.ts of the component
  Interrupt expiry. This manipulatio…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-400
  - CWE-404
vendor: ag-ui-protocol
product: ag-ui
affected:
  - ag-ui 0.0.1
  - ag-ui 0.0.2
  - ag-ui 0.0.3
  - ag-ui 0.0.4
  - ag-ui 0.0.5
  - ag-ui 0.0.6
  - ag-ui 0.0.7
  - ag-ui 0.0.8
  - ag-ui 0.0.9
  - ag-ui 0.0.10
  - ag-ui 0.0.11
  - ag-ui 0.0.12
  - ag-ui 0.0.13
  - ag-ui 0.0.14
  - ag-ui 0.0.15
  - ag-ui 0.0.16
  - ag-ui 0.0.17
  - ag-ui 0.0.18
  - ag-ui 0.0.19
  - ag-ui 0.0.20
  - ag-ui 0.0.21
  - ag-ui 0.0.22
  - ag-ui 0.0.23
  - ag-ui 0.0.24
  - ag-ui 0.0.25
  - ag-ui 0.0.26
  - ag-ui 0.0.27
  - ag-ui 0.0.28
  - ag-ui 0.0.29
  - ag-ui 0.0.30
  - ag-ui 0.0.31
  - ag-ui 0.0.32
  - ag-ui 0.0.33
  - ag-ui 0.0.34
  - ag-ui 0.0.35
  - ag-ui 0.0.36
  - ag-ui 0.0.37
  - ag-ui 0.0.38
  - ag-ui 0.0.39
  - ag-ui 0.0.40
  - ag-ui 0.0.41
  - ag-ui 0.0.42
  - ag-ui 0.0.43
  - ag-ui 0.0.44
  - ag-ui 0.0.45
  - ag-ui 0.0.46
  - ag-ui 0.0.47
  - ag-ui 0.0.48
  - ag-ui 0.0.49
  - ag-ui 0.0.50
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T15:47:53.754628Z'
exploitAvailable: true
published: '2026-11-01'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T15:48:07.908Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120237'
references:
  - url: 'https://vuldb.com/vuln/429596'
    label: >-
      VDB-429596 | ag-ui-protocol ag-ui Interrupt expiry index.ts
      isInterruptExpired resource consumption
  - url: 'https://vuldb.com/vuln/429596/cti'
    label: 'VDB-429596 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-120237'
    label: CVE-2026-120237 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1015179'
    label: 'Submit #1015179 | ag-ui-protocol ag-ui <=0.0.58 CWE-400'
  - url: 'https://github.com/ag-ui-protocol/ag-ui/issues/2525'
  - url: 'https://github.com/ag-ui-protocol/ag-ui/pull/3241'
  - url: 'https://github.com/ag-ui-protocol/ag-ui/'
tags:
  - cve.org
  - exploit-available
epss: 0.00407
epssPercentile: 0.35187
ingestedAt: '2026-11-05T21:36:00.918Z'
---

## Overview

A flaw has been found in ag-ui-protocol ag-ui up to 0.0.58. Affected by this issue is the function isInterruptExpired of the file sdks/typescript/packages/client/src/interrupts/index.ts of the component Interrupt expiry. This manipulation causes resource consumption. Remote exploitation of the attack is possible. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.

## Affected

- `ag-ui 0.0.1`
- `ag-ui 0.0.2`
- `ag-ui 0.0.3`
- `ag-ui 0.0.4`
- `ag-ui 0.0.5`
- `ag-ui 0.0.6`
- `ag-ui 0.0.7`
- `ag-ui 0.0.8`
- `ag-ui 0.0.9`
- `ag-ui 0.0.10`
- `ag-ui 0.0.11`
- `ag-ui 0.0.12`
- `ag-ui 0.0.13`
- `ag-ui 0.0.14`
- `ag-ui 0.0.15`
- `ag-ui 0.0.16`
- `ag-ui 0.0.17`
- `ag-ui 0.0.18`
- `ag-ui 0.0.19`
- `ag-ui 0.0.20`
- `ag-ui 0.0.21`
- `ag-ui 0.0.22`
- `ag-ui 0.0.23`
- `ag-ui 0.0.24`
- `ag-ui 0.0.25`
- `ag-ui 0.0.26`
- `ag-ui 0.0.27`
- `ag-ui 0.0.28`
- `ag-ui 0.0.29`
- `ag-ui 0.0.30`
- `ag-ui 0.0.31`
- `ag-ui 0.0.32`
- `ag-ui 0.0.33`
- `ag-ui 0.0.34`
- `ag-ui 0.0.35`
- `ag-ui 0.0.36`
- `ag-ui 0.0.37`
- `ag-ui 0.0.38`
- `ag-ui 0.0.39`
- `ag-ui 0.0.40`
- `ag-ui 0.0.41`
- `ag-ui 0.0.42`
- `ag-ui 0.0.43`
- `ag-ui 0.0.44`
- `ag-ui 0.0.45`
- `ag-ui 0.0.46`
- `ag-ui 0.0.47`
- `ag-ui 0.0.48`
- `ag-ui 0.0.49`
- `ag-ui 0.0.50`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.