{"id":"CVE-2026-120236","kind":"vulnerability","aliases":["CVE-2026-120236"],"related":[],"title":"ag-ui protocol: improper input validation in transport decoder handler","description":"A vulnerability was detected in ag-ui-protocol ag-ui up to 0.0.58. Affected by this vulnerability is an unknown functionality of the component Transport Decoder Handler. The manipulation results in improper input validation. The attack may be launched remotely. The exploit is now public and may be used. The patch is identified as 660182b973a44b8eda5484b14b88eb9cc251edc4. It is suggested to upgrade the affected component.","summary":"The ag-ui-protocol ag-ui package up to version 0.0.58 fails to validate input in its transport decoder handler. A remote attacker can send crafted data to trigger the flaw, and a public exploit exists.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ag-ui","ai-agents","ai-tooling","python","typescript"],"not_affected_if":["ag-ui-not-used"],"how_to_check":"- Check the installed ag-ui-protocol version, for example with `pip show ag-ui-protocol` or `npm ls @ag-ui/core`, and compare it to `0.0.58`","fix":"- Upgrade the affected ag-ui component past `0.0.58`; the source references patch commit 660182b973a44b8eda5484b14b88eb9cc251edc4 but does not name a fixed release version","status":"open","published_at":"2026-11-01T17:16:33+00:00","first_seen_at":"2026-11-01T17:21:03+00:00","triaged_at":"2026-11-01T17:22:58+00:00","updated_at":"2026-11-01T17:22:58+00:00","category":"ai-tooling","confidence":0.5,"triage":{"at":"2026-11-01T17:22:58Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the affected ag-ui component past `0.0.58`; the source references patch commit 660182b973a44b8eda5484b14b88eb9cc251edc4 but does not name a fixed release version","reach":"internet","title":"ag-ui protocol: improper input validation in transport decoder handler","impact":"medium","summary":"The ag-ui-protocol ag-ui package up to version 0.0.58 fails to validate input in its transport decoder handler. A remote attacker can send crafted data to trigger the flaw, and a public exploit exists.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["ag-ui","ai-agents","python","typescript"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown; input validation flaw may allow crafted remote requests to affect the decoder","analyst_note":"Confirm the fixed release version and whether the attack needs authentication or special transport configuration, using the NVD entry and the linked patch commit.","how_to_check":"- Check the installed ag-ui-protocol version, for example with `pip show ag-ui-protocol` or `npm ls @ag-ui/core`, and compare it to `0.0.58`\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["ag-ui-not-used"],"who_is_affected":"Teams that run the ag-ui protocol component in an agent or AI application and expose its transport endpoint to incoming requests are the ones to look at. Deployments that do not use ag-ui, or that run it only on a closed internal path, can likely skip it, but the sources do not say that explicitly.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000723,"input_tokens":4170,"output_tokens":613,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120236':14A,17A '-2026':13A,16A '0.0.58':41B,81C '660182b973a44b8eda5484b14b88eb9cc251edc4':123C 'affect':82C,130C 'ag':2A,19B,31B,35B,73C,77C 'ag-ui':1A,18B,34B,76C 'ag-ui-protocol':30B,72C 'agent':23B 'ai':22B,25B 'ai-ag':21B 'ai-tool':24B 'attack':53B,104C 'compon':92C,131C 'craft':56B 'cve':12A,15A 'data':57B 'decod':10A,49B,94C 'detect':70C 'exist':66B 'exploit':65B,110C 'fail':42B 'flaw':61B 'function':89C 'handler':11A,50B,95C 'identifi':121C 'improp':5A,100C 'input':6A,45B,101C 'launch':107C 'manipul':97C 'may':105C,115C 'packag':37B 'patch':119C 'protocol':4A,33B,75C 'public':64B,113C 'python':27B 'remot':52B,108C 'result':98C 'send':55B 'suggest':126C 'tool':26B 'transport':9A,48B,93C 'trigger':59B 'typescript':28B 'ui':3A,20B,32B,36B,74C,78C 'unknown':88C 'upgrad':128C 'use':117C 'valid':7A,44B,102C 'version':40B 'vulner':68C,85C","nicknames":[],"mitigations":[],"who_affected":"Teams that run the ag-ui protocol component in an agent or AI application and expose its transport endpoint to incoming requests are the ones to look at. Deployments that do not use ag-ui, or that run it only on a closed internal path, can likely skip it, but the sources do not say that explicitly.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-11-01T17:16:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120236","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120236","severity":null,"published_at":"2026-11-01T17:16:33+00:00","modified_at":"2026-11-01T17:16:33+00:00","first_seen_at":"2026-11-01T17:21:03+00:00","fetched_at":"2026-11-01T17:21:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}