AG-UI CVE-2026-92360

Requires the AG-UI TypeScript client SDK (@ag-ui/client, ag-ui 1.0) to process an attacker-influenced protocol event stream - specifically a sequence where a run emits an interrupt outcome and a subsequent run in the same stream finishes without a corresponding resume (per PR #2701), or a crafted TEXT_MESSAGE_START event that defeats origin validation (per the description). PR:L indicates some level of privilege/authenticated context in the event pipeline is needed, and exploitation is limited to LOW impact on each of C/I/A. Limiting factors: the vulnerability affects only deployments that consume untrusted or compromised agent event sources, and impact is bounded (no RCE, no full data disclosure); the fix is not yet confirmed merged, so no patched version is verified.

This is a medium-severity issue (vendor CVSS 4.0 base 5.3) with no signals of elevated real-world risk. The provided vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L is network-reachable and low-complexity but requires some privilege (PR:L) and yields only LOW impact across confidentiality, integrity and availability - consistent with a trust-boundary/validation weakness (CWE-346) rather than code execution or bulk data exposure. There is no EPSS score, no CISA KEV listing, and no public exploit code - so this is 'no public exploit identified at time of analysis,' not active exploitation. Exploitation status field E:X (Not Defined) confirms exploit maturity is unstated. A notable data conflict exists: the VulDB-authored description attributes the flaw to prepareRunAgentInput in agent/agent.ts via manipulation of the TEXT_MESSAGE_START argument causing an 'origin validation error,' but the actual linked fix (PR #2701) modifies pendingInterrupts / RUN_FINISHED gate logic in apply/default.ts so that a stream emitting an interrupt outcome and then opening a second run of its own cannot silently release the interrupt gate - an integrity/trust-boundary bug, not an obvious information-disclosure or origin-header bug. The description and the code evidence do not cleanly align; treat the precise attack surface as unverified and confirm with the vendor. Net: a legitimate but low-priority validation weakness in a niche OSS project, not a high-CVSS-but-inflated critical.

A client application connects to a malicious or compromised AG-UI agent event stream; the server emits an interrupt outcome and then, without the client ever resuming it, starts and finishes a second run in the same stream, causing the client to drop the unanswered interrupt gate and proceed with the interrupt unaddressed (or, per the description, to mishandle a crafted TEXT_MESSAGE_START event so an event's origin/trust check is bypassed). No public exploit code exists, and the low impact metrics (VC:L/VI:L/VA:L) indicate limited, non-catastrophic consequences. Exploitation is remote but bounded by the client having to process attacker-influenced protocol events.