This vulnerability in TinyAGI 0.0.20 involves the buildSystemPrompt function within packages/server/src/routes/agents.ts, which can be manipulated remotely to cause file inclusion. This could allow an attacker to include arbitrary files on the server, potentially leading to information disclosure or further exploitation. The issue was reported early to the project, but no remediation or official fix has been released. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality impact.

An attacker can remotely exploit this vulnerability to include files on the server, which may lead to unauthorized access to sensitive information or facilitate further attacks. The confidentiality impact is limited, and there is no direct integrity or availability impact reported. The exploit is publicly available, increasing the risk of exploitation despite no known active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, consider restricting access to the affected functionality or applying temporary controls to limit exposure.