Five AG-UI Protocol CVEs — Agent Frontends Become an Attack Surface; Three Bugs Have No Fix Release Yet

All five CVEs target `@ag-ui/client`, the TypeScript client for the AG-UI protocol (Agent-User Interaction Protocol — the standard for streaming state/tool calls/generative UI from agent backends to frontends such as CopilotKit).

(1) **CVE-2026-120233** (CVSS 3.1 5.3): HttpAgent builds its fetch without the redirect option — a malicious/compromised agent endpoint can answer the run POST with a redirect to an origin of its choosing; the re-sent request carries the run envelope (`threadId`, `runId`) and developer headers including tenant headers. Public exploit exists.

(2) **CVE-2026-120234**: error responses are read entirely into memory with no size limit.