Live › vulnerability › CVE-2026-120233
The ag-ui TypeScript client's HttpAgent component, in versions up to 0.0.58, has a flaw in sdks/typescript/packages/client/src/agent/http.ts that lets a manipulated request disclose information. A public exploit exists, and a fix pull request is pending but not yet merged.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 16:20 UTC. All times on this page are UTC.
Teams whose applications use the ag-ui TypeScript client's HttpAgent to talk to remote agent endpoints are the ones exposed. Projects that do not use the ag-ui client package can skip it. The sources do not say which data is disclosed or what conditions the request must meet.
No product ranges from the sources yet.
@ag-ui/client version in your package.json and lockfile against 0.0.580.0.58; the sources do not name a fixed release, only a pending pull requestEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security flaw has been discovered in ag-ui-protocol ag-ui up to 0.0.58. This affects an unknown function of the file sdks/typescript/packages/client/src/agent/http.ts of the component HttpAgent. Performing a manipulation results in information disclosure. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.
This page as .md · .json · in your agent: get_signal("CVE-2026-120233")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.