AG-UI CVE-2026-120236

The vulnerable component is the AG-UI transport decode/middleware path that parses inbound event content (the patch wraps resultEvent.content through contentToText() before tryParseA2UIOperations and tryParseRecoveryFailure in the a2ui-middleware, indicating non-text or structured content was parsed without proper validation). Exploitation requires network reach to an AG-UI endpoint and low-level privileges (PR:L) - i.e., the attacker must be an authorized participant able to submit events over the transport, not an anonymous internet attacker. Affected versions are ag-ui up to and including 0.0.58; the dependency bump to @ag-ui/core>=0.0.59 and the 2026-10-30 release indicate the fix lands in 0.0.59, so running a patched build removes the exposure. No user interaction is required (UI:N), but the exact content shape needed to trigger the flaw is not described in the available sources.

This is a medium-severity issue (CVSS 4.0 base 5.3) whose signals are internally consistent and point to moderate, not urgent, priority. The vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N shows a remotely reachable, low-complexity flaw that nonetheless requires some privilege level (PR:L), so it is not an unauthenticated internet-wide bug; the impact metrics VC:L/VI:L/VA:L with no subsequent-system impact (SC:N/SI:N/SA:N) indicate limited, bounded consequences consistent with the 'Information Disclosure' tag. The input carries an exploit-maturity of E:P (proof-of-concept) and a PoC reference, but no EPSS score is provided and the CVE is NOT on CISA KEV, so there is no evidence of active or widespread exploitation. The vuln.today decision label is 'this_month', which aligns with a real-but-non-emergency fix cadence rather than act_now. Net: a legitimate issue to patch in routine cycles, not a drop-everything priority; the main caveat is that it is a very early-version (0.0.x) component and the exact trigger is not described in the sources, so impact bounds rest on the CVSS vector rather than a detailed root-cause analysis.

An attacker with low-level access to an AG-UI transport channel sends crafted or malformed event content to the Transport Decoder/middleware, which fails to validate it properly during parsing (CWE-20). The low-complexity network vector (AV:N/AC:L) with required privileges (PR:L) suggests the result is limited information disclosure or minor integrity/availability effects rather than code execution. A public PoC reference exists (GitHub issue #2524); it is not verified as working exploit code.