CVE-2026-19009 is a file inclusion vulnerability affecting TinyAGI version 0.0.20. The flaw exists in the collectFiles function within the packages/core/src/response.ts file of the Message API Endpoint component. This weakness allows remote attackers to include files via crafted input, which can lead to unauthorized file access or code execution depending on the context. The vulnerability has been publicly disclosed with exploit code available. The project has been notified but has not yet provided a fix or official mitigation guidance.

An attacker can remotely exploit this vulnerability to include arbitrary files, potentially leading to unauthorized disclosure of sensitive information or further compromise of the affected system. The availability of public exploit code increases the risk of exploitation. However, no known active exploitation in the wild has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or issued a fix, users should monitor official channels for updates. Until a patch is available, consider restricting access to the vulnerable API endpoint or implementing network-level controls to limit exposure.