CVE-2026-120236

AG-UI protobuf events bypass the SSE schema checks

AG-UI Protocol · @ag-ui/client protobuf transport validation

First documented disclosure · Review checkpoint

Summary

A malformed event rejected on the text transport can reach client state through the protobuf path.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: Controlled researcher evidence; the reviewed primary sources do not establish malicious exploitation or a confirmed victim.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The old SSE path parses EventSchemas before emission, while the protobuf path emits decoded events without equivalent validation.

Conditions required

An attacker controls the agent response and protobuf content type, or can alter an unprotected response; TLS interception is not presumed.

Potential impact

Invalid event data can corrupt run state or prevent completion. The reported numeric message-ID test demonstrates validation asymmetry and a stuck run, not arbitrary code execution or proven data exfiltration.

Affected versions and configurations

CNA lists through 0.0.58; the validation asymmetry is also present in the inspected 0.0.59 package.

Fix and mitigation status

Fix commit 660182b9 merged September 17. Published 1.0.0 includes a shared enforcement stage before event application; also present in 1.0.3.

Practical next steps

Use a supported client with shared event enforcement and test both transports. Validate protocol fields at a common boundary before trusted application logic consumes them.

Operating lesson

Changing the wire format must not weaken the validation contract.

Evidence and limits

Public issue August 25; AG-UI 1.0 PR opened September 16 and merged September 17; CNA November 1. CNA scores 5.3 CVSS 4.0 and 6.3 v3.1. Read-only source inspection verifies 1.0.0 enforcement; the linked October 30 adapter release alone cannot prove a client fix.

Sources