TinyAGI vulnerabilities
3 known CVE vulnerabilities in TinyAGI, translated and rated.
- CVE-2026-19011Medium
A vulnerability was found in TinyAGI 0.0.20 in the buildSystemPrompt function of packages/server/src/routes/agents.ts, allowing file inclusion. The attack can be initiated remotely. The exploit is public. The project was informed but has not responded.
- CVE-2026-19010High
A vulnerability was detected in TinyAGI 0.0.20 in the processMessage function of packages/main/src/index.ts in the Message API Endpoint component. Missing authorization allows remote attack. The exploit is public, and the project has not responded.
- CVE-2026-19009High
A vulnerability was found in TinyAGI 0.0.20 in the collectFiles function of packages/core/src/response.ts in the Message API Endpoint component. This manipulation causes file inclusion. The attack can be initiated remotely, and the exploit is public.