Five new CVEs, published 1 November 2026, hit the TypeScript client for AG-UI, the Agent-User Interaction Protocol. It lets an AI agent backend stream state, tool calls and generative UI to AI agent frontends such as CopilotKit. Two are already fixed, in npm package @ag-ui/client version 1.0.0 (current release 1.0.3); the other three still have no released fix.
ag-ui-protocol/ag-ui is the open specification and TypeScript client behind AG-UI; CopilotKit and other agent-frontend tools build on the same client package, @ag-ui/client. VulDB assigned and published all five CVE ids, under its own CNA identifier, cna@vuldb.com. None has a GitHub Security Advisory: GitHub’s advisory database lists one entry for this repository, for a different package and a different bug. Each of the five has a proof-of-concept exploit published in its own GitHub issue.
The five cover different weaknesses in the same client. CVE-2026-120233: HttpAgent follows HTTP redirects by default, so a malicious agent endpoint can redirect the credential-bearing run request to an attacker-chosen origin. A different mechanism caused a similar outcome in Plex Media Server’s CVE-2026-96652, where the server itself fetched an attacker-supplied address rather than following a redirect. CVE-2026-120234: the HTTP transport also reads an entire error response into memory with no size cap, for any non-2xx status.
CVE-2026-120235: the SSE parser buffers an unterminated stream tail in a string with no cap, so a boundary-less response can grow memory without limit. CVE-2026-120236: the protobuf decoder skips the schema validation the SSE path enforces, so a malformed event can corrupt the run’s state. CVE-2026-120237: interrupt expiry treats a missing expiresAt field as never-expiring, so one RUN_FINISHED message can stall a thread’s runs permanently.
CVE-2026-120235 and CVE-2026-120236 are already fixed. Both closed in npm release @ag-ui/client 1.0.0, published 17 September 2026, confirmed against the project’s own release notes. CVE-2026-120233, CVE-2026-120234 and CVE-2026-120237 have only an open, unmerged pull request as a fix. @ag-ui/client 1.0.3, the current release, does not contain any of the three, confirmed directly against the published source.
Which of the Five Are Actually Fixed
The table below is complete: all five CVEs, the component each hits, the CWE, the CVSS 3.1 score NVD lists, the affected range, and the fixed version. NVD also lists a CVSS 4.0 score for each: 5.5 for CVE-2026-120233, and 2.1 for the other four.
| CVE id | Component | CWE | CVSS 3.1 | Affected | Fixed version |
|---|---|---|---|---|---|
| CVE-2026-120233 | HttpAgent (http.ts) | CWE-200, CWE-284 | 5.3 Medium | 0.0.1-0.0.58 | Not fixed; PR #2575 open |
| CVE-2026-120234 | HTTP Transport (e.text) | CWE-400, CWE-404 | 4.3 Medium | 0.0.1-0.0.58 | Not fixed; PR #2698 open |
| CVE-2026-120235 | SSE Parser (sse.ts) | CWE-400, CWE-404 | 4.3 Medium | 0.0.1-0.0.58 | 1.0.0 |
| CVE-2026-120236 | Transport Decoder Handler | CWE-20 | 6.3 Medium | 0.0.1-0.0.58 | 1.0.0 |
| CVE-2026-120237 | Interrupt expiry (index.ts) | CWE-400, CWE-404 | 4.3 Medium | 0.0.1-0.0.58 | Not fixed; PR #3241 open |
Finding and Patching @ag-ui/client
Dependency scanners that key only on the GitHub organization name, ag-ui-protocol, or the repository name can miss this: the published npm package is @ag-ui/client. A different TypeScript npm package, openapi-typescript-codegen, recently carried its own code injection flaw, CVE-2026-108551. None of the five CVEs is in CISA’s Known Exploited Vulnerabilities catalog as of 1 November 2026.
- Upgrade @ag-ui/client to 1.0.3, or at least 1.0.0.Closes CVE-2026-120235 and CVE-2026-120236; no version before 1.0.0 has either fix.
- Find every app that bundles or pins ag-ui-protocol/ag-ui or @ag-ui/client, including through CopilotKit or another agent-frontend integration.The package name, not the GitHub org name, is what a scan needs to match.
- Re-run your SCA and dependency scans once the upgrade lands.Confirms the scanner now reads 1.0.0 or later, not the still-affected 0.0.x line.
- Track pull requests #2575, #2698 and #3241.They fix CVE-2026-120233, CVE-2026-120234 and CVE-2026-120237; none is merged, so no release closes these three yet.