ag-ui CVE-2026-101101

Exploitation requires the ability to supply the 'arguments' field of a tool call processed by the ag-ui A2A middleware (the send_message_to_a2a_agent tool path), where the value is malformed JSON or valid JSON that is not a usable object (null, a bare number, a string, or an array). No user interaction is needed (UI:N) and it is network-reachable (AV:N), but it requires low-level privilege/authenticated access to inject that input (PR:L) - an unauthenticated external actor with no path to influence tool-call arguments cannot trigger it. Impact is limited to disrupting/hanging the affected agent run stream (availability only); there is no data exposure or state corruption. Limited to deployments running ag-ui middleware versions up to 2026-09-07 (fixed in release 2026-09-08).

This is a genuine but low-severity availability issue, not a high-CVSS-but-low-risk overstatement - the vendor CVSS 4.0 base score is only 5.3 (medium) and the sole impact metric set is VA:L (low availability), with VC:N/VI:N confirming no confidentiality or integrity effect. The vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N, meaning network-reachable, low attack complexity, no user interaction, but PR:L - exploitation requires some level of privilege/authenticated access to submit input that reaches the middleware. CWE-248 (uncaught exception) is consistent with the source evidence: malformed or non-object JSON in tool-call arguments causes JSON.parse (or a subsequent field access on a parsed non-object such as null/number/array) to throw where nothing catches it, so the agent event stream hangs or errors rather than degrading gracefully - a self-inflicted denial-of-condition on a single run/session, not a service-wide crash. EPSS is not provided, KEV status is not listed (not actively exploited), and no public exploit code is referenced (VulDB-sourced disclosure with linked issue/PR). SSVC-style read: exploitation=none observed, technical impact=partial (availability only), automatable is plausible given AV:N/AC:L but the payoff is merely disrupting a stream. Net: real, patchable, low priority. Note the tag 'Information Disclosure' conflicts with the actual impact profile (availability, VC:N) and appears mislabeled.

An attacker with the privilege to influence a tool call's arguments (PR:L) submits an assistant message whose function arguments are malformed JSON (e.g. '{"agentName": "some-agent"') or parse to a non-object like 'null', '42', or '[]'. When the A2A middleware's convert/JSON.parse path processes it, the exception is thrown inside a synchronous .map callback before any Promise.all/.catch guard exists, so the run stream neither completes nor errors and hangs. No public exploit code is identified at time of analysis; the disclosure and reproducing tests originate from GitHub issue #2444 and PR #2493.