CVE-2026-19009 identifies a file inclusion vulnerability in TinyAGI 0.0.20 affecting the collectFiles function in packages/core/src/response.ts of the Message API Endpoint. The flaw allows remote attackers to manipulate file inclusion, potentially leading to unauthorized file access or execution. The vulnerability is exploitable without privileges or user interaction. Although an exploit is publicly available, no official remediation or patch has been released by the vendor as of the publication date.

Successful exploitation allows remote attackers to include files, which may lead to unauthorized disclosure of sensitive information or execution of arbitrary code depending on the context of the included files. The vulnerability does not require authentication or user interaction, increasing its risk. However, the CVSS score of 6.9 reflects a medium severity impact with low to limited confidentiality, integrity, and availability impacts.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's communications for updates and consider implementing temporary mitigations such as restricting access to the vulnerable API endpoint or employing web application firewalls to detect and block file inclusion attempts. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.