CVE-2026-120236

2.1 low

Low (2.1).

A vulnerability was detected in ag-ui-protocol ag-ui up to 0.0.58. Affected by this vulnerability is an unknown functionality of the component Transport Decoder Handler. The manipulation results in improper input validation. The attack may be launched remotely. The exploit is now public and may be used. The patch is identified as 660182b973a44b8eda5484b14b88eb9cc251edc4. It is suggested to upgrade the affected component.

Severity

CVSS 4.0

2.1 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

6.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CWE: CWE-20 Improper Input Validation
Published: 2026-11-01 17:16 UTC
Modified: 2026-11-01 17:16 UTC
Record from: the NVD, synced 2026-11-01 17:45 UTC

Ask an AI about this CVE

ChatGPT Claude Perplexity Google AI Mode

Show the prompt

Explain CVE-2026-120236 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-120236?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-120236?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an estimate of exploitation activity across the internet over the next 30 days, not a prediction for my systems). Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.

References

Check your stack JSON