CVE-2026-92184

Name of the Vulnerable Software and Affected Versions ag-ui-protocol ag-ui version 0.3.0

Description A security flaw in the Multimodal Content component allows for remote server-side request forgery (SSRF), a condition where an attacker can induce the server to make requests to an unintended location. The issue exists within the urllib.request.urlopen() function located in the integrations/aws-strands/python/src/ag ui strands/utils.py file, triggered by the manipulation of the Value argument.

Recommendations Apply patch bf0c34df34cbb4b1992bc37c9bfffe6dd54bb189 to version 0.3.0.