CVE-2026-19009
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A vulnerability was found in TinyAGI 0.0.20 in the collectFiles function of packages/core/src/response.ts in the Message API Endpoint component. This manipulation causes file inclusion. The attack can be initiated remotely, and the exploit is public.
Risk Assessment
A remote attacker can exploit the vulnerability to include unauthorized files, potentially leading to disclosure of sensitive information or code execution.
Recommendation
Secure the collectFiles function against file inclusion by implementing proper validation and restrictions. Update TinyAGI when a patch is available.
Other vulnerabilities in TinyAGI
See all- CVE-2026-19011Medium
A vulnerability was found in TinyAGI 0.0.20 in the buildSystemPrompt function of packages/server/src/routes/agents.ts, allowing file inclusion. The attack can be initiated remotely. The exploit is public. The project was informed but has not responded.
- CVE-2026-19010High
A vulnerability was detected in TinyAGI 0.0.20 in the processMessage function of packages/main/src/index.ts in the Message API Endpoint component. Missing authorization allows remote attack. The exploit is public, and the project has not responded.
Original NVD description (English source)
A weakness has been identified in TinyAGI 0.0.20. This issue affects the function collectFiles of the file packages/core/src/response.ts of the component Message API Endpoint. This manipulation causes file inclusion. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.