Description
A vulnerability has been found in ag-ui-protocol ag-ui up to 2026-09-07. This issue affects the function JSON.parse of the file legacy/convert.ts of the component Middleware. The manipulation leads to uncaught exception. Remote exploitation of the attack is possible. Upgrading to version 2026-09-08 is capable of addressing this issue. The identifier of the patch is 30f8c794d5b73df5c610153043db502b2cc106cc. Upgrading the affected component is recommended.
Published: 2026-09-28
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote exploitation via unhandled JSON.parse exception
Action: Immediate Patch
AI Analysis

Impact

The vulnerability causes the JSON.parse function in the legacy/convert.ts file of the ag-ui component to throw an uncaught exception when supplied with crafted input. This lack of error handling can be triggered remotely, potentially causing the application or service that relies on ag‑ui to fail. The flaw is a standard uncontrolled exception weakness, identified as CWE-248.

Affected Systems

All versions of the ag-ui component from ag‑ui‑protocol released up to and including 2026‑09‑07 are affected. The issue is addressed in release 2026‑09‑08, which incorporates the patch identified by commit 30f8c794d5b73df5c610153043db502b2cc106cc.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate risk, and the EPSS score is currently unavailable. The vulnerability is not listed in the CISA KEV catalog, but the vendor explicitly states that remote exploitation is possible. This vulnerability therefore represents a realistic, although currently unproven, risk of application failure caused by an unhandled exception.

Generated by OpenCVE AI on September 28, 2026 at 20:29 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade ag‑ui to release 2026‑09‑08, which incorporates the fixed JSON.parse logic; the commit 30f8c794d5b73df5c610153043db502b2cc106cc contains the relevant changes.
  • Enclose calls to JSON.parse in legacy/convert.ts with explicit input validation or a try/catch block to prevent uncontrolled exceptions; this mitigates the weakness identified as CWE‑248.
  • After updating the component, restart or reload any services that depend on ag‑ui to ensure the new code is active and to clear any state left in an error condition.

Generated by OpenCVE AI on September 28, 2026 at 20:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 02 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Mon, 28 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 28 Sep 2026 18:00:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in ag-ui-protocol ag-ui up to 2026-09-07. This issue affects the function JSON.parse of the file legacy/convert.ts of the component Middleware. The manipulation leads to uncaught exception. Remote exploitation of the attack is possible. Upgrading to version 2026-09-08 is capable of addressing this issue. The identifier of the patch is 30f8c794d5b73df5c610153043db502b2cc106cc. Upgrading the affected component is recommended.
Title ag-ui-protocol ag-ui Middleware convert.ts JSON.parse uncaught exception
First Time appeared Ag-ui-protocol
Ag-ui-protocol ag-ui
Weaknesses CWE-248
CPEs cpe:2.3:a:ag-ui-protocol:ag-ui:*:*:*:*:*:*:*:*
Vendors & Products Ag-ui-protocol
Ag-ui-protocol ag-ui
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:N/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Ag-ui-protocol Ag-ui
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-28T18:13:33.954Z

Reserved: 2026-09-28T02:53:41.099Z

Link: CVE-2026-101101

cve-icon Vulnrichment

Updated: 2026-09-28T18:13:30.741Z

cve-icon NVD

Status : Deferred

Published: 2026-09-28T18:17:17.193

Modified: 2026-09-28T21:03:44.987

Link: CVE-2026-101101

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-28T17:45:11Z

Links: CVE-2026-101101 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-28T22:00:09Z

Weaknesses