CVE-2026-19011: TinyAGI Path Traversal Vulnerability

CVE-2026-19011 Overview

CVE-2026-19011 is a file inclusion vulnerability in TinyAGI version 0.0.20, an open-source lightweight agent framework. The flaw resides in the buildSystemPrompt function inside packages/server/src/routes/agents.ts. Attackers can manipulate input to trigger unauthorized file inclusion over the network without authentication. A public exploit is available, increasing the risk of opportunistic attacks. The project maintainers were notified through an issue report but have not responded at the time of publication.

Critical Impact
Remote unauthenticated attackers can influence the file-inclusion path handled by buildSystemPrompt, potentially exposing local files consumed by the agent runtime. [CWE-73]

Affected Products

TinyAGI 0.0.20
TinyAGI server component (packages/server)
Deployments exposing the agents API route

Discovery Timeline

2026-08-06 - CVE-2026-19011 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-19011

Vulnerability Analysis

The vulnerability affects the buildSystemPrompt function in packages/server/src/routes/agents.ts within the TinyAGI server. The function accepts attacker-controlled input that participates in constructing a file path used by the agent's system prompt builder. Because the path is not restricted to a safe base directory, an attacker can influence which file the server reads and folds into the prompt context. This behavior aligns with CWE-73: External Control of File Name or Path. The exploit has been published and can be executed remotely without authentication or user interaction, according to the VulDB CVE-2026-19011 entry.

Root Cause

The root cause is missing validation of a file path parameter consumed by buildSystemPrompt. The function trusts caller-supplied input when resolving the location of prompt content on disk. Without canonicalization or an allow-list, path segments outside of the intended prompt directory can be referenced during request handling.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request to the TinyAGI agents endpoint. The request supplies a parameter influencing the file resolved by buildSystemPrompt. The server then reads the attacker-referenced file and incorporates its contents into the model's system prompt or response context. See the GitHub Issue Tracker for the reported reproduction context.

No verified proof-of-concept code has been released by NVD. Refer to the VulDB Vulnerability Details for additional technical context.

Detection Methods for CVE-2026-19011

Indicators of Compromise

HTTP requests to the TinyAGI /agents route containing path traversal sequences such as ../, absolute paths, or unexpected file extensions in parameters consumed by buildSystemPrompt.
TinyAGI server process reading files outside the intended prompts directory, especially /etc/, application config files, or credential stores.
Anomalous outbound responses from the agent that echo contents of local files back to the requester.

Detection Strategies

Instrument the Node.js server to log the resolved absolute path used inside buildSystemPrompt and alert on paths escaping the designated prompts directory.
Deploy Web Application Firewall (WAF) rules that inspect request bodies and query parameters for path traversal patterns targeting the agents route.
Correlate open/readFile system call telemetry against the TinyAGI process to identify unexpected file reads.

Monitoring Recommendations

Monitor filesystem access telemetry for the TinyAGI service and baseline the set of files it normally reads.
Track HTTP 200 responses from the agents endpoint whose response bodies contain markers typical of local system files (for example, root:x: from /etc/passwd).
Enable verbose request logging on the TinyAGI reverse proxy and forward events to a centralized analytics store for retrospective hunting.

How to Mitigate CVE-2026-19011

Immediate Actions Required

Restrict network exposure of the TinyAGI server to trusted internal networks or place it behind an authenticated gateway.
Audit historical logs of the agents endpoint for path traversal payloads and evidence of unauthorized file reads.
Run the TinyAGI process with a least-privilege service account so that any inclusion is limited to non-sensitive files.

Patch Information

No vendor patch is available. The project was notified via the GitHub Issue Tracker but has not responded as of publication. Track fixes in the TinyAGI GitHub repository.

Workarounds

Fork or locally patch packages/server/src/routes/agents.ts so buildSystemPrompt resolves paths only within an allow-listed prompts directory using path.resolve and a prefix check.
Add input validation that rejects parameters containing .., null bytes, absolute paths, or non-alphanumeric filename characters.
Place TinyAGI behind a reverse proxy that strips or blocks traversal sequences before requests reach the application.

bash

# Example nginx guard: block traversal patterns on the agents route
location /agents {
    if ($request_uri ~* "(\.\./|\.\.%2f|%2e%2e/|/etc/|/root/)") {
        return 403;
    }
    proxy_pass http://tinyagi_backend;
}