جزئیات آسیب‌پذیری
CVE-2026-120235
ag-ui-protocol ag-ui
ag-ui-protocol ag-ui SSE Parser sse.ts parseSSEStream resource consumption
CVSS 4.0
5.3متوسط
نمای کلی
اکسپلویت‌های عمومی
اخبار مرتبط
خط زمانی
خلاصه‌ی فارسی
خلاصه‌ی فارسی برای این آسیب‌پذیری هنوز تهیه نشده است.
شرح رسمی (انگلیسی)
A security vulnerability has been detected in ag-ui-protocol ag-ui up to 0.0.58. Affected is the function parseSSEStream of the file sdks/typescript/packages/client/src/transform/sse.ts of the component SSE Parser. The manipulation leads to resource consumption. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is 9e7b2b00bce215bbf731f1e6094f63812527c432. The affected component should be upgraded.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 5.3متوسط | 4.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P |
| 4.3متوسط | 3.1 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C |
| 4.3متوسط | 3.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C |
| 4.0متوسط | 2.0 | CVEProject cvelistV5 (CNA) (VulDB) | AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| ag-ui-protocol | ag-ui | 0.0.1 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.10 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.11 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.12 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.13 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.14 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.15 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.16 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.17 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.18 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.19 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.2 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.20 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.21 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.22 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.23 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.24 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.25 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.26 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.27 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.28 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.29 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.3 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.30 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.31 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.32 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.33 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.34 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.35 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.36 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.37 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.38 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.39 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.4 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.40 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.41 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.42 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.43 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.44 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.45 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.46 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.47 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.48 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.49 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.5 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.50 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.51 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.52 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.53 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.54 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.55 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.56 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.57 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.58 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.6 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.7 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.8 | CVEProject cvelistV5 (CNA) |
| ag-ui-protocol | ag-ui | 0.0.9 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۹- https://vuldb.com/vuln/429594 vdb-entrytechnical-description
- https://vuldb.com/vuln/429594/cti signaturepermissions-required
- https://vuldb.com/cve/CVE-2026-120235 third-party-advisory
- https://vuldb.com/submit/1015147 third-party-advisory
- https://github.com/ag-ui-protocol/ag-ui/issues/2522 exploitissue-tracking
- https://github.com/ag-ui-protocol/ag-ui/pull/2627 issue-trackingpatch
- https://github.com/ag-ui-protocol/ag-ui/commit/9e7b2b00bce215bbf731f1e6094f63812527c432 patch
- https://github.com/ag-ui-protocol/ag-ui/releases/tag/release/2026-10-30 patch
- https://github.com/ag-ui-protocol/ag-ui/ product
اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۸/۱۰
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۸/۱۱
- وضعیت
- PUBLISHED
- صادرکننده (CNA)
- VulDB
- اولویت کلون
- به‌زودی
پیش‌بینی بهره‌برداری (EPSS)
۰٫۳۵٪
احتمال بهره‌برداری در ۳۰ روز
۲۹٫۱٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- Automatable
- no
- Exploitation
- poc
- Technical Impact
- partial
ضعف‌ها (CWE)
- CWE-400Resource Consumption
- CWE-404Denial of Service