CVE-2026-120236: ag-ui-protocol ag-ui Transport Decoder input validation

Published Nov 1, 2026

Updated

A vulnerability was detected in ag-ui-protocol ag-ui up to 0.0.58. Affected by this vulnerability is an unknown functionality of the component Transport Decoder Handler. The manipulation results in improper input validation. The attack may be launched remotely. The exploit is now public and may be used. The patch is identified as 660182b973a44b8eda5484b14b88eb9cc251edc4. It is suggested to upgrade the affected component.

Event History

Nov 1, 2026

CVE Published

via OSV·04:45 PM

Data Sourced

via OSV·04:45 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Deployments using ag-ui-protocol ag-ui versions up to 0.0.58 are affected. The issue is in an unspecified Transport Decoder Handler functionality.

What access does an attacker need?

The issue can be exploited remotely, but the provided severity vector indicates the attacker requires low-level privileges. No user interaction is required.

Is public exploit code available?

Yes. The available data states that an exploit is public and may be used.

What should teams do to remediate this issue?

Upgrade the affected ag-ui component to a version containing patch commit 660182b973a44b8eda5484b14b88eb9cc251edc4.

CVE-2026-120236: ag-ui-protocol ag-ui Transport Decoder input validation

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

Is public exploit code available?

What should teams do to remediate this issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need?

Is public exploit code available?

What should teams do to remediate this issue?