ag-ui-protocol ag-ui SDK Information Disclosure Vulnerability (CVE-2026-120233)
Executive & SecOps Summary
SECOPS ASSESSMENTApplications utilizing ag-ui-protocol ag-ui package up to version 0.0.58
Remote attackers can exploit the HttpAgent component to trigger unauthorized information disclosure of sensitive system data
Apply the code changes from the official pull request (PR #2575) or implement strict response filtering on HttpAgent outputs
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
As the official fix is currently pending in Pull Request #2575, you can temporarily target the patch branch directly or upgrade once the PR is merged.
# Install the patched version directly from the pull request branch
npm install github:ag-ui-protocol/ag-ui#pull/2575/head --save2. Temporary Workaround & Hardening Configuration
If upgrading is not immediately feasible, intercept and sanitize all outgoing and incoming payloads handled by the HttpAgent to prevent sensitive data leakage.
// Example middleware to strip sensitive headers and fields from HttpAgent responses
export function secureAgentResponse(response: any) {
const blacklistedKeys = ['authorization', 'cookie', 'x-api-key', 'internal_addr'];
return JSON.parse(JSON.stringify(response, (key, value) => {
return blacklistedKeys.includes(key.toLowerCase()) ? undefined : value;
}));
}3. Log Audit & IoC Verification Commands
Verify if your project contains the vulnerable dependency and audit application logs for suspicious reconnaissance activities targeting the HTTP client.
# Check the installed version of ag-ui in your node_modules
npm ls ag-ui
# Scan application logs for anomalous HttpAgent error patterns or token leakage
grep -rn 'HttpAgent' ./logs/ | grep -Ei '(unauthorized|token|credential|env)'Scan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
A security flaw has been identified in the ag-ui package within the TypeScript SDK file sdks/typescript/packages/client/src/agent/http.ts of the HttpAgent component. Due to insufficient access control (CWE-284) and improper data sanitization (CWE-200), the component fails to restrict sensitive information from being exposed during HTTP request processing.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated remote attacker can initiate an attack by sending manipulated parameters or headers to the HttpAgent. Because the agent does not properly filter internal execution states or error responses, it discloses sensitive metadata, internal API endpoints, or authorization headers back to the client. Public exploits have been released, increasing the likelihood of active exploitation.
3. Infrastructure & Business Impact
Successful exploitation allows attackers to map internal API structures and harvest credentials or tokens. This exposure significantly lowers the barrier for subsequent attacks, such as unauthorized API abuse, privilege escalation, or lateral movement within the cloud infrastructure.
Official Vendor Advisories & References
A security flaw has been discovered in ag-ui-protocol ag-ui up to 0.0.58. This affects an unknown function of the file sdks/typescript/packages/client/src/agent/http.ts of the component HttpAgent. Performing a manipulation results in information disclosure. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.
Frequently Asked SecOps Questions (CVE-2026-120233)
FAQQ1. How critical is CVE-2026-120233 and is it actively exploited in the wild?
CVE-2026-120233 is rated CVSS 5.3 (MEDIUM) with a 30-day EPSS exploitation probability of 0.4%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2026-120233?
Primary impacted vendors include ag-ui-protocol across ag-ui. Scope summary: ag-ui-protocol ag-ui package up to version 0.0.58 (affecting TypeScript SDK HttpAgent)
Q3. What temporary mitigations or workarounds exist for CVE-2026-120233 before patching?
[Mitigation] Apply the code changes from the official pull request (PR #2575) or implement strict response filtering on HttpAgent outputs Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2026-120233
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (ag-ui-protocol)
View Category →Gitea API Heatmap Endpoint Information Disclosure Vulnerability (CVE-2026-114199)
[Affected Scope] Gitea versions prior to v28.3.0
Gitea Actions Task Token Authorization Bypass Leading to Private Repository Metadata Disclosure (CVE-2026-112887)
[Affected Scope] Gitea instances running versions prior to v28.3.0 with Gitea Actions enabled
GitLab CE/EE Unauthenticated Remote Code Execution (RCE) Advisory (CVE-2026-97229)
[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)
GitLab CE/EE Unauthenticated Arbitrary File Read Vulnerability (CVE-2026-85706)
[Affected Scope] GitLab CE/EE versions from 18.7 through 19.3.1.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.