Threats affecting pkg:github/tinyagi/tinyagi

A vulnerability was detected in TinyAGI 0.0.20. The affected element is the function buildSystemPrompt of the file packages/server/src/routes/agents.ts. Performing a manipulation results in file inclusion. The attack may be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-19010 is a medium severity vulnerability in TinyAGI version 0.0.20 affecting the processMessage function in the Message API Endpoint. It allows remote attackers to bypass authorization controls, potentially enabling unauthorized actions. The vulnerability has been publicly disclosed, but no official patch or remediation has been provided by the vendor as of the publication date.

TinyAGI version 0.0.20 contains a file inclusion vulnerability in the collectFiles function within the Message API Endpoint component. This vulnerability can be exploited remotely without authentication. Public exploit code is available, but the vendor has not yet responded or issued a fix. The CVSS 4.0 base score is 6.9, indicating a medium severity risk.