Threat Intelligence Database

A medium severity vulnerability (CVE-2026-19011) exists in TinyAGI version 0.0.20 within the buildSystemPrompt function of packages/server/src/routes/agents.ts. This flaw allows remote attackers to perform file inclusion via crafted input. The vulnerability has a public exploit available, but no official patch or vendor response has been issued yet.

A vulnerability was detected in TinyAGI 0.0.20. The affected element is the function buildSystemPrompt of the file packages/server/src/routes/agents.ts. Performing a manipulation results in file inclusion. The attack may be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

A security vulnerability exists in TinyAGI version 0.0.20 affecting the processMessage function in the Message API Endpoint. This flaw allows remote attackers to bypass authorization checks, potentially leading to unauthorized access. The vulnerability has a CVSS score of 7.3 (medium severity). The issue was publicly disclosed and reported to the project, but no response or patch has been issued yet.

CVE-2026-19010 is a medium severity vulnerability in TinyAGI version 0.0.20 affecting the processMessage function in the Message API Endpoint. It allows remote attackers to bypass authorization controls, potentially enabling unauthorized actions. The vulnerability has been publicly disclosed, but no official patch or remediation has been provided by the vendor as of the publication date.

TinyAGI version 0.0.20 contains a file inclusion vulnerability in the collectFiles function within the Message API Endpoint component. This vulnerability can be exploited remotely without authentication. Public exploit code is available, but the vendor has not yet responded or issued a fix. The CVSS 4.0 base score is 6.9, indicating a medium severity risk.