CVE-2026-19009

HIGH 7.3

TinyAGI Message API Endpoint response.ts collectFiles file inclusion

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

A weakness has been identified in TinyAGI 0.0.20. This issue affects the function collectFiles of the file packages/core/src/response.ts of the component Message API Endpoint. This manipulation causes file inclusion. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-73
Vendor	n/a
Product	tinyagi
Published	Aug 6, 2026

Stay Ahead of the Next One

Get instant alerts for n/a tinyagi

Be the first to know when new high vulnerabilities affecting n/a tinyagi are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

n/a / TinyAGI

0.0.20

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/386402 vuldb.com: https://vuldb.com/vuln/386402/cti vuldb.com: https://vuldb.com/cve/CVE-2026-19009 vuldb.com: https://vuldb.com/submit/862672 github.com: https://github.com/TinyAGI/tinyagi/issues/282 github.com: https://github.com/TinyAGI/tinyagi/

Credits

🔍 JondaChen (VulDB User) VulDB CNA Team