CVE-2026-19011 is a file inclusion vulnerability in TinyAGI 0.0.20 affecting the buildSystemPrompt function in the file packages/server/src/routes/agents.ts. An attacker can remotely manipulate input to cause file inclusion, potentially exposing or executing unintended files. The vulnerability is classified under CWE-73 (External Control of File Name or Path). The exploit code is publicly available, and the project has been notified but has not responded or released a fix. The CVSS 3.1 base score is 5.3 (medium severity) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact.

The vulnerability allows remote attackers to include files via manipulation of the buildSystemPrompt function, potentially leading to unauthorized disclosure of file contents. There is no indication of integrity or availability impact. The presence of a public exploit increases the risk of exploitation, although no active exploitation in the wild is currently known.

No official patch or fix is currently available, and the vendor has not responded to the issue report. Users should monitor the vendor's channels for updates and consider implementing temporary mitigations such as input validation or restricting file access permissions where possible. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.