What is CVE-2026-92360?

CVE-2026-92360 is a medium-severity vulnerability in Ag-Ui-Protocol Ag-Ui, classified under Insufficient Verification of Data Authenticity. CVSS score: 6.3/10. Published 2026-09-16.

How severe is CVE-2026-92360?

Medium severity. CVSS v3 base score is 6.3 out of 10.

Vulnerability in Ag-Ui-Protocol Ag-Ui

CVE-2026-92360

A weakness has been identified in ag-ui-protocol ag-ui 1.0. The impacted element is the function prepareRunAgentInput of the file agent/agent.ts of the component Event Application Layer. This manipulation of the argument TEXT_MESSAGE_START causes origin validation error. Remote exploitation of the attack is possible. The pull request to fix this issue awaits acceptance.

CVSS v3 metric

CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.

Affected products

Ag-ui-protocol Ag-ui — versions 1.0

Weakness classification (CWE)

References

cna@vuldb.com (technical-description, vdb-entry)
cna@vuldb.com (signature, permissions-required)
cna@vuldb.com (third-party-advisory)
cna@vuldb.com (third-party-advisory)
cna@vuldb.com (issue-tracking)
cna@vuldb.com (issue-tracking, patch)
cna@vuldb.com (product)

Frequently asked questions

What is CVE-2026-92360?: CVE-2026-92360 is a medium-severity vulnerability in Ag-Ui-Protocol Ag-Ui, classified under Insufficient Verification of Data Authenticity. CVSS score: 6.3/10. Published 2026-09-16.
How severe is CVE-2026-92360?: Medium severity. CVSS v3 base score is 6.3 out of 10.