Executive brief
ag-ui is a framework for integrating AI agents into frontend applications. The library contains a server-side request forgery vulnerability in its URL content fetching component, which allows remote attackers to make arbitrary HTTP requests from the server. An attacker could use this to access internal resources, cloud metadata endpoints, or perform attacks against services only accessible from the server's network.
Technical details
The vulnerability is a server-side request forgery (SSRF) in the urllib.request.urlopen function call within the Multimodal Content component (integrations/aws-strands/python/src/ag_ui_strands/utils.py). The flaw allows manipulation of URL arguments passed to the function without proper validation before the fetch is executed. An unauthenticated remote attacker can send a crafted message containing a malicious URL, which the server will fetch server-side, potentially exposing internal resources or cloud metadata. The vulnerability was patched in commit bf0c34df34cbb4b1992bc37c9bfffe6dd54bb189 with server-side URL validation and a UrlFetchPolicy restricting fetches to public HTTP/HTTPS only and blocking non-public address spaces.
Affected products
- ag-ui-protocol ag-ui 0.3.0
Timeline
- 2026-09-16: disclosed
- 2026-08-25: patched: Patch commit bf0c34df34cbb4b1992bc37c9bfffe6dd54bb189