CVE-2026-120233

medium

Description

A security flaw has been discovered in ag-ui-protocol ag-ui up to 0.0.58. This affects an unknown function of the file sdks/typescript/packages/client/src/agent/http.ts of the component HttpAgent. Performing a manipulation results in information disclosure. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.

References

https://vuldb.com/vuln/429592/cti

https://vuldb.com/vuln/429592

https://vuldb.com/submit/1015143

https://vuldb.com/cve/CVE-2026-120233

https://github.com/ag-ui-protocol/ag-ui/pull/2575

https://github.com/ag-ui-protocol/ag-ui/issues/2520

https://github.com/ag-ui-protocol/ag-ui/

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-114858

Details

Source: Mitre, NVD

Published: 2026-11-01

Updated: 2026-11-02

Risk Information

CVSS v2

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 5.3

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Severity: Medium

CVSS v4

Base Score: 6.9

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.00414