4.3
MediumCVSS 3.1 · from VulDB
CVE-2026-120237
ag-ui-protocol ag-ui Interrupt expiry index.ts isInterruptExpired resource consumption
ag-ui · Uncontrolled resource use · CWE-400Affectedag-ui
FixA patch is linked in the references.
PublishedNov 1, 17:30 · VulDB
ScoredNov 1 · 4.3 · VulDB
Exploit code publicNone known · checked 23:18 UTC
ExploitedNone known · CISA KEV checked 23:19 UTC
What we know
No known exploitation. CISA KEV, checked 23:19 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 23:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
Description
A flaw has been found in ag-ui-protocol ag-ui up to 0.0.58. Affected by this issue is the function isInterruptExpired of the file sdks/typescript/packages/client/src/interrupts/index.ts of the component Interrupt expiry. This manipulation causes resource consumption. Remote exploitation of the attack is possible. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.
From VulDB
Affected and fixed versions
ProductAffectedFixed inag-ui0.0.1–ag-ui0.0.2–ag-ui0.0.3–ag-ui0.0.4–ag-ui0.0.5–ag-ui0.0.6–ag-ui0.0.7–ag-ui0.0.8–ag-ui0.0.9–ag-ui0.0.10–ag-ui0.0.11–ag-ui0.0.12–ag-ui0.0.13–ag-ui0.0.14–ag-ui0.0.15–ag-ui0.0.16–ag-ui0.0.17–ag-ui0.0.18–ag-ui0.0.19–ag-ui0.0.20–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known