CVE-2026-92360

MEDIUMCVSS 6.3

Description

A weakness has been identified in ag-ui-protocol ag-ui 1.0. The impacted element is the function prepareRunAgentInput of the file agent/agent.ts of the component Event Application Layer. This manipulation of the argument TEXT_MESSAGE_START causes origin validation error. Remote exploitation of the attack is possible. The pull request to fix this issue awaits acceptance.

Timeline

Published:September 16th, 2026 1:18 PM

Last modified:September 23rd, 2026 11:10 AM

CVSS Scoring

CVSS v3: 6.3 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CVSS v2: 6.5

Weaknesses (CWE)

CWE-345 CWE-346

References & Reports

Advisories, patches, and third-party reports

https://github.com/ag-ui-protocol/ag-ui/
https://github.com/ag-ui-protocol/ag-ui/issues/2437
https://github.com/ag-ui-protocol/ag-ui/pull/2701
https://vuldb.com/cve/CVE-2026-92360
https://vuldb.com/submit/934950
https://vuldb.com/vuln/405446
https://vuldb.com/vuln/405446/cti

Source: NIST NVD · Data may lag official sources by up to one minute