CVE-2026-19009: TinyAGI File Inclusion RCE Vulnerability

CVE-2026-19009 Overview

CVE-2026-19009 is a file inclusion vulnerability affecting TinyAGI 0.0.20. The flaw resides in the collectFiles function within packages/core/src/response.ts, part of the Message API Endpoint component. Remote attackers can manipulate file path handling to include unintended files from the host system. A public exploit for this weakness is available, increasing the likelihood of opportunistic attacks against exposed TinyAGI deployments. The maintainers were notified through an issue report but have not responded at the time of publication. The vulnerability is classified under CWE-73: External Control of File Name or Path.

Critical Impact
Unauthenticated remote attackers can trigger file inclusion through the Message API, potentially exposing sensitive files processed by the TinyAGI runtime.

Affected Products

TinyAGI 0.0.20
packages/core/src/response.ts (collectFiles function)
Message API Endpoint component

Discovery Timeline

2026-08-06 - CVE-2026-19009 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-19009

Vulnerability Analysis

The vulnerability affects TinyAGI, an open-source agent framework. The collectFiles function inside packages/core/src/response.ts handles file references supplied through the Message API Endpoint. Because the function accepts file identifiers without adequate validation, an attacker can influence which files the server reads and returns. Successful exploitation results in unauthorized disclosure of files readable by the TinyAGI process. The issue is exploitable over the network and requires no authentication or user interaction. Public exploit code lowers the barrier to entry for opportunistic actors targeting exposed instances.

Root Cause

The root cause is external control of a file name or path [CWE-73]. collectFiles treats attacker-supplied input as a trusted path component, allowing traversal-style or absolute-path values to reach filesystem read operations. The absence of allowlisting, canonicalization, and boundary checks against a designated resource directory permits references outside the intended scope.

Attack Vector

An attacker sends a crafted request to the Message API Endpoint containing a manipulated file reference. The collectFiles routine resolves the value and reads the target file, embedding its contents in the response. Because the endpoint is reachable remotely and does not gate the input behind authentication, exploitation can be automated at scale. Refer to the VulDB CVE Record and the GitHub Issue Tracker for reference material.

Detection Methods for CVE-2026-19009

Indicators of Compromise

HTTP requests to the Message API Endpoint containing path traversal sequences such as ../, absolute paths, or references to files outside the intended message asset directory.
Unexpected outbound responses from TinyAGI containing contents of system files, configuration files, or source code.
Error entries or stack traces from collectFiles referencing unusual filesystem locations.

Detection Strategies

Inspect application and reverse proxy logs for suspicious file identifiers passed to the Message API, particularly non-relative or encoded path characters.
Deploy web application firewall rules that flag traversal patterns targeting Node.js and TypeScript endpoints running TinyAGI.
Correlate process file-open events on hosts running TinyAGI to identify reads outside the expected message asset directory.

Monitoring Recommendations

Baseline the set of files legitimately accessed by the TinyAGI service and alert on deviations.
Enable verbose request logging on the Message API Endpoint until a fix is available.
Watch the TinyAGI GitHub repository for maintainer response and patch commits.

How to Mitigate CVE-2026-19009

Immediate Actions Required

Restrict network exposure of the TinyAGI Message API Endpoint to trusted networks or place it behind an authenticated reverse proxy.
Audit the collectFiles code path in packages/core/src/response.ts and identify all callers that accept untrusted file identifiers.
Remove or disable message features that resolve file references from client-supplied values until a vendor patch is issued.

Patch Information

No official patch was available from the TinyAGI project at the time of CVE publication. The maintainers were notified through an issue report but have not responded. Track the GitHub Issue Tracker and the VulDB Vulnerability Record for remediation updates.

Workarounds

Enforce an allowlist of permitted filenames and reject any input containing path separators, null bytes, or encoded traversal sequences.
Canonicalize file paths and verify they resolve within a dedicated message asset directory before passing them to filesystem APIs.
Run the TinyAGI process under a least-privilege service account with read access limited to the message asset directory.
Apply reverse-proxy filtering that blocks requests containing ../, absolute paths, or references to sensitive files such as /etc/passwd, .env, or private keys.

bash

# Configuration example: nginx filter blocking traversal sequences before they reach TinyAGI
location /api/message {
    if ($request_uri ~* "(\.\./|\.\.\\|%2e%2e|/etc/|\.env)") {
        return 403;
    }
    proxy_pass http://tinyagi_backend;
}