5.3
MediumCVSS 3.1 · from VulDB
CVE-2026-120233
ag-ui-protocol ag-ui HttpAgent http.ts information disclosure
ag-ui · Information exposure · CWE-200Affectedag-ui
FixA patch is linked in the references.
PublishedNov 1, 15:15 · VulDB
ScoredNov 1 · 5.3 · VulDB
Exploit code publicNone known · checked 23:18 UTC
ExploitedNone known · CISA KEV checked 23:19 UTC
What we know
No known exploitation. CISA KEV, checked 23:19 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 23:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
Description
A security flaw has been discovered in ag-ui-protocol ag-ui up to 0.0.58. This affects an unknown function of the file sdks/typescript/packages/client/src/agent/http.ts of the component HttpAgent. Performing a manipulation results in information disclosure. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.
From VulDB
Affected and fixed versions
ProductAffectedFixed inag-ui0.0.1–ag-ui0.0.2–ag-ui0.0.3–ag-ui0.0.4–ag-ui0.0.5–ag-ui0.0.6–ag-ui0.0.7–ag-ui0.0.8–ag-ui0.0.9–ag-ui0.0.10–ag-ui0.0.11–ag-ui0.0.12–ag-ui0.0.13–ag-ui0.0.14–ag-ui0.0.15–ag-ui0.0.16–ag-ui0.0.17–ag-ui0.0.18–ag-ui0.0.19–ag-ui0.0.20–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known