CVE-2026-101101

ag-ui-protocol ag-ui Middleware convert.ts JSON.parse uncaught exception

View on CVE.org
Published Sep 28, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability has been found in ag-ui-protocol ag-ui up to 2026-09-07. This issue affects the function JSON.parse of the file legacy/convert.ts of the component Middleware. The manipulation leads to uncaught exception. Remote exploitation of the attack is possible. Upgrading to version 2026-09-08 is capable of addressing this issue. The identifier of the patch is 30f8c794d5b73df5c610153043db502b2cc106cc. Upgrading the affected component is recommended.

Analysis

AI-generated

Technical impact

The vulnerability causes the JSON.parse function in the legacy/convert.ts file of the ag-ui component to throw an uncaught exception when supplied with crafted input. This lack of error handling can be triggered remotely, potentially causing the application or service that relies on ag‑ui to fail. The flaw is a standard uncontrolled exception weakness, identified as CWE-248.

Affected Systems

All versions of the ag-ui component from ag‑ui‑protocol released up to and including 2026‑09‑07 are affected. The issue is addressed in release 2026‑09‑08, which incorporates the patch identified by commit 30f8c794d5b73df5c610153043db502b2cc106cc.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate risk, and the EPSS score is currently unavailable. The vulnerability is not listed in the CISA KEV catalog, but the vendor explicitly states that remote exploitation is possible. This vulnerability therefore represents a realistic, although currently unproven, risk of application failure caused by an unhandled exception.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade ag‑ui to release 2026‑09‑08, which incorporates the fixed JSON.parse logic; the commit 30f8c794d5b73df5c610153043db502b2cc106cc contains the relevant changes.
  • Enclose calls to JSON.parse in legacy/convert.ts with explicit input validation or a try/catch block to prevent uncontrolled exceptions; this mitigates the weakness identified as CWE‑248.
  • After updating the component, restart or reload any services that depend on ag‑ui to ensure the new code is active and to clear any state left in an error condition.

Generated by OpenCVE AI on September 28, 2026 at 20:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability has been found in ag-ui-protocol ag-ui up to 2026-09-07. This issue affects the function JSON.parse of the file legacy/convert.ts of the component Middleware. The manipulation leads to uncaught exception. Remote exploitation of the attack is possible. Upgrading to version 2026-09-08 is capable of addressing this issue. The identifier of the patch is 30f8c794d5b73df5c610153043db502b2cc106cc. Upgrading the affected component is recommended.
Title ag-ui-protocol ag-ui Middleware convert.ts JSON.parse uncaught exception
First Time appeared Ag-ui-protocol
Ag-ui-protocol ag-ui
Weaknesses CWE-248
CPEs cpe:2.3:a:ag-ui-protocol:ag-ui:*:*:*:*:*:*:*:*
Vendors & Products Ag-ui-protocol
Ag-ui-protocol ag-ui
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:N/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 28, 2026, 6:13 PM
Reserved
Sep 28, 2026, 2:53 AM

View source JSON

Updated
Sep 28, 2026, 6:13 PM

JSON

Status
Deferred
Published
Sep 28, 2026, 6:17 PM
Modified
Sep 28, 2026, 9:03 PM

View source JSON

Severity
Moderate
Public date
Sep 28, 2026, 5:45 PM

View source Bugzilla JSON

Updated
Sep 28, 2026, 10:00 PM

JSON