{"id":"CVE-2026-120237","kind":"vulnerability","aliases":["CVE-2026-120237"],"related":[],"title":"ag-ui protocol: interrupt expiry check lets remote requests exhaust resources","description":"A flaw has been found in ag-ui-protocol ag-ui up to 0.0.58. Affected by this issue is the function isInterruptExpired of the file sdks/typescript/packages/client/src/interrupts/index.ts of the component Interrupt expiry. This manipulation causes resource consumption. Remote exploitation of the attack is possible. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.","summary":"The ag-ui-protocol TypeScript client, up to version 0.0.58, has a flaw in its interrupt expiry check (isInterruptExpired). A remote attacker can trigger excessive resource consumption, and a public exploit has been published.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ag-ui","ai-agents","ai-tooling","typescript"],"not_affected_if":["no-ag-ui-interrupts","versions-above-0.0.58"],"how_to_check":"- Check the installed version of the `@ag-ui/client` or `ag-ui-protocol` package in your lockfile, looking for versions up to `0.0.58`\n- Search your code for uses of `isInterruptExpired` from the ag-ui client package","fix":"- Fixed version: unknown; a pull request to fix the issue is awaiting acceptance","status":"open","published_at":"2026-11-01T18:17:13+00:00","first_seen_at":"2026-11-01T18:21:31+00:00","triaged_at":"2026-11-01T18:23:37+00:00","updated_at":"2026-11-01T18:23:37+00:00","category":"ai-tooling","confidence":0.5,"triage":{"at":"2026-11-01T18:23:37Z","model":"claude-haiku-5-5","output":{"fix":"- Fixed version: unknown; a pull request to fix the issue is awaiting acceptance","reach":"internet","title":"ag-ui protocol: interrupt expiry check lets remote requests exhaust resources","impact":"low","summary":"The ag-ui-protocol TypeScript client, up to version 0.0.58, has a flaw in its interrupt expiry check (isInterruptExpired). A remote attacker can trigger excessive resource consumption, and a public exploit has been published.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["ag-ui","typescript","ai-agents"],"confidence":0.5,"fix_status":"none","needs_auth":"unknown","worst_case":"Remote requests exhaust server resources and degrade service availability","analyst_note":"Confirm the fixed version and the exact trigger conditions for the isInterruptExpired resource consumption flaw in the ag-ui repository and the NVD entry.","how_to_check":"- Check the installed version of the `@ag-ui/client` or `ag-ui-protocol` package in your lockfile, looking for versions up to `0.0.58`\n- Search your code for uses of `isInterruptExpired` from the ag-ui client package","plain_action":"","needs_analyst":true,"not_affected_if":["no-ag-ui-interrupts","versions-above-0.0.58"],"who_is_affected":"Teams running the ag-ui TypeScript client that handles interrupts up to version 0.0.58. The source says remote exploitation is possible, but does not describe the exact request path or deployment conditions needed to reach the vulnerable function. Teams not using ag-ui's interrupt handling can likely skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000728,"input_tokens":4164,"output_tokens":624,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120237':15A,18A '-2026':14A,17A '0.0.58':39B,79C 'accept':126C 'affect':80C 'ag':2A,20B,31B,71C,75C 'ag-ui':1A,19B,74C 'ag-ui-protocol':30B,70C 'agent':24B 'ai':23B,26B 'ai-ag':22B 'ai-tool':25B 'attack':51B,106C 'await':125C 'caus':99C 'check':7A,47B 'client':35B 'compon':94C 'consumpt':56B,101C 'cve':13A,16A 'excess':54B 'exhaust':11A 'expiri':6A,46B,96C 'exploit':60B,103C,110C 'file':90C 'fix':122C 'flaw':42B,65C 'found':68C 'function':86C 'interrupt':5A,45B,95C 'isinterruptexpir':48B,87C 'issu':83C,124C 'let':8A 'manipul':98C 'may':115C 'possibl':108C 'protocol':4A,33B,73C 'public':59B 'publish':63B,113C 'pull':119C 'remot':9A,50B,102C 'request':10A,120C 'resourc':12A,55B,100C 'sdks/typescript/packages/client/src/interrupts/index.ts':91C 'tool':27B 'trigger':53B 'typescript':28B,34B 'ui':3A,21B,32B,72C,76C 'use':117C 'version':38B","nicknames":[],"mitigations":[],"who_affected":"Teams running the ag-ui TypeScript client that handles interrupts up to version 0.0.58. The source says remote exploitation is possible, but does not describe the exact request path or deployment conditions needed to reach the vulnerable function. Teams not using ag-ui's interrupt handling can likely skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"first_public_at":"2026-11-01T18:17:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120237","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120237","severity":null,"published_at":"2026-11-01T18:17:13+00:00","modified_at":"2026-11-01T18:17:13+00:00","first_seen_at":"2026-11-01T18:21:31+00:00","fetched_at":"2026-11-01T18:21:31+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}