CVE-2026-19009
Received Received - Intake

File Inclusion Vulnerability in TinyAGI 0.0.20

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: VulDB

Description
A weakness has been identified in TinyAGI 0.0.20. This issue affects the function collectFiles of the file packages/core/src/response.ts of the component Message API Endpoint. This manipulation causes file inclusion. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-19009
EUVD
EUVD-2026-53767

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
tinyagi tinyagi to 0.0.20 (inc)
tinyagi tinyagi 0.0.21
tinyagi tinyagi 0.0.20

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-19009 is a file inclusion vulnerability in TinyAGI 0.0.20 affecting the Message API Endpoint. It allows remote attackers to manipulate file paths via a crafted message, causing the system to include arbitrary files in responses without validation.

Detection Guidance

Check TinyAGI version with 'npm list tinyagi' or 'docker inspect <container> | grep Image'. Look for version 0.0.20 or earlier. Monitor POST /api/message endpoint logs for unusual file paths in responses. Inspect system files accessed by TinyAGI workers for unexpected outbound attachments.

Impact Analysis

An attacker could exploit this to read sensitive files on the host system, such as configuration files, logs, or workspace data. This could lead to data leaks, unauthorized access, or further attacks depending on the exposed files.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data or HIPAA by leaking protected health information if such files are accessible. Compliance may be impacted due to unauthorized data disclosure.

Mitigation Strategies

Upgrade TinyAGI to version 0.0.21 or later immediately. If upgrading is not possible, restrict network access to the POST /api/message endpoint using firewalls. Disable file attachment features if unused. Review and remove sensitive files from directories accessible by TinyAGI.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19009. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart