Live › vulnerability › CVE-2026-120237
The ag-ui-protocol TypeScript client, up to version 0.0.58, has a flaw in its interrupt expiry check (isInterruptExpired). A remote attacker can trigger excessive resource consumption, and a public exploit has been published.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 18:21 UTC. All times on this page are UTC.
Teams running the ag-ui TypeScript client that handles interrupts up to version 0.0.58. The source says remote exploitation is possible, but does not describe the exact request path or deployment conditions needed to reach the vulnerable function. Teams not using ag-ui's interrupt handling can likely skip it.
No product ranges from the sources yet.
@ag-ui/client or ag-ui-protocol package in your lockfile, looking for versions up to 0.0.58isInterruptExpired from the ag-ui client packageEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw has been found in ag-ui-protocol ag-ui up to 0.0.58. Affected by this issue is the function isInterruptExpired of the file sdks/typescript/packages/client/src/interrupts/index.ts of the component Interrupt expiry. This manipulation causes resource consumption. Remote exploitation of the attack is possible. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.
This page as .md · .json · in your agent: get_signal("CVE-2026-120237")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.