Description
A weakness has been identified in ag-ui-protocol ag-ui 1.0. The impacted element is the function prepareRunAgentInput of the file agent/agent.ts of the component Event Application Layer. This manipulation of the argument TEXT_MESSAGE_START causes origin validation error. Remote exploitation of the attack is possible. The pull request to fix this issue awaits acceptance.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ag-ui-protocol | ag-ui | 1.0 | — |
References
- VDB-405446 | ag-ui-protocol ag-ui Event Application Layer agent.ts prepareRunAgentInput origin validation vdb-entry technical-description
- VDB-405446 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-92360 | CVE Analysis and Report third-party-advisory
- Submit #934950 | ag-ui-protocol ag-ui v1.0 CWE-346 third-party-advisory
- https://github.com/ag-ui-protocol/ag-ui/issues/2437 issue-tracking
- https://github.com/ag-ui-protocol/ag-ui/pull/2701 issue-tracking patch
- https://github.com/ag-ui-protocol/ag-ui/ product