CVE-2026-19019
Received Received - Intake

Incomplete Cleanup in poco-agent WorkspaceManager

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: VulDB

Description
A security flaw has been discovered in poco-ai poco-agent up to 0.5.4. Affected is the function WorkspaceManager._setup_session_persistence of the file executor/app/core/workspace.py of the component Claude File Handler. The manipulation results in incomplete cleanup. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-19019
EUVD
EUVD-2026-53818

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
poco-ai poco-agent to 0.5.4 (exc)
poco-ai poco-agent to 0.5.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-459 The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a destructive local file deletion issue in the poco-agent executor service. When a task starts, the executor's WorkspaceManager._setup_session_persistence() function unconditionally deletes the user's ~/.claude directory if it exists as a real directory and replaces it with a symlink. This occurs before any task execution and is triggered by submitting a valid task payload to the executor's API.

Detection Guidance

Check if poco-agent versions 0.5.4 or earlier are installed by running: poco-agent --version. Inspect network traffic for requests to the /v1/tasks/execute endpoint. Verify if ~/.claude directory exists and contains critical user data before task execution.

Impact Analysis

The vulnerability can lead to permanent loss of user data, including chat history stored under ~/.claude/projects. It is particularly dangerous in deployments where the host's HOME directory is bind-mounted into the executor container, allowing remote-triggered data loss.

Mitigation Strategies

Upgrade poco-agent to versions greater than 0.5.4 immediately. If upgrading is not possible, restrict access to the /v1/tasks/execute endpoint via network policies. Avoid running poco-agent outside disposable containers if bind-mounted to host HOME directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19019. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart