CVE-2026-120237

AG-UI interrupts without expiry can block further thread runs

AG-UI Protocol · @ag-ui/client interrupt lifecycle

First documented disclosure · Review checkpoint

Summary

An agent can leave non-expiring pending interrupts that block later runs until all are addressed.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: Controlled researcher evidence; the reviewed primary sources do not establish malicious exploitation or a confirmed victim.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Missing expiresAt is treated as not expired, without a default lifetime. The next run requires a response for every pending interrupt, so partial resumption leaves the thread blocked.

Conditions required

A producer can emit a RUN_FINISHED interrupt outcome omitting expiry, and the application attempts to resume without addressing every pending interrupt.

Potential impact

Agent-session availability loss and an unbounded pending-interrupt backlog. The test observed a partial resume timing out; it does not prove the thread is irrecoverable if every interrupt is explicitly handled.

Affected versions and configurations

CNA lists through 0.0.58; missing-expiry behavior remains in published 1.0.3 source inspected on November 2.

Fix and mitigation status

No released fix verified. PR #3241 proposing a default lifetime and pending-count cap remains open and unmerged.

Practical next steps

Require bounded interrupt expiry and count in integrations; offer an explicit recovery path that addresses every outstanding interrupt. Review the pending maintainer fix before adoption.

Operating lesson

Human-approval gates need bounded lifetimes and an explicit cancellation path.

Evidence and limits

Public report August 25; proposed fix October 28; CNA November 1. The proposal uses seven days and 100 pending interrupts, but is not a shipped guarantee. Current source requires all pending IDs to be resolved or cancelled; avoid the original report’s broader claim of permanent irrecoverability.

Sources