CVE-2026-19011

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-19011

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19011.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-19011

Published

2026-08-06T07:15:08.949Z

Modified

2026-08-08T03:48:18.179500772Z

Severity

5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

TinyAGI agents.ts buildSystemPrompt file inclusion

Details

A vulnerability was detected in TinyAGI 0.0.20. The affected element is the function buildSystemPrompt of the file packages/server/src/routes/agents.ts. Performing a manipulation results in file inclusion. The attack may be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-73"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19011.json"
}

References

Affected packages

Git / github.com/tinyagi/tinyagi

Affected ranges

Type

GIT

Repo

https://github.com/tinyagi/tinyagi

Events

Introduced

1ae8b4eba2fcb963a076655a7293fc77eafeb84c

Last affected

1ae8b4eba2fcb963a076655a7293fc77eafeb84c

Database specific

{
    "extracted_events": [
        {
            "introduced": "0.0.20"
        },
        {
            "last_affected": "0.0.20"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*

0.0.20

v0.*

v0.0.20

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19011.json"