EUVD-2026-53791
GHSA-2r4w-xxv7-6r74
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable with no authentication or prerequisites; confidentiality impact is low (bounded file read), no integrity or availability impact, and scope is unchanged.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in TinyAGI 0.0.20. The affected element is the function buildSystemPrompt of the file packages/server/src/routes/agents.ts. Performing a manipulation results in file inclusion. The attack may be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
File inclusion in TinyAGI 0.0.20 exposes server-side files to remote unauthenticated attackers through the buildSystemPrompt function in packages/server/src/routes/agents.ts. Exploitation requires no privileges or user interaction, and a publicly available proof-of-concept exists via GitHub issue #283. No patch has been released - the vendor has not responded to the responsible disclosure despite being notified through the project's issue tracker.
Technical ContextAI
TinyAGI is a Node.js-based AI agent framework. The vulnerable function buildSystemPrompt in packages/server/src/routes/agents.ts constructs a system prompt by reading file content, but fails to properly validate or sanitize externally supplied file path input. CWE-73 (External Control of File Name or Path) describes this root cause class: user-supplied data directly controls which file the server reads, enabling path traversal-style arbitrary file inclusion. The CPE string cpe:2.3:a:n/a:tinyagi:*:*:*:*:*:*:*:* uses 'n/a' as the vendor field, indicating TinyAGI is an independent open-source project with no official vendor namespace in the NVD database, and the wildcard version range suggests NVD has not bounded the affected scope beyond version 0.0.20 cited in the disclosure.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor has not responded to the disclosure reported via GitHub issue #283 at https://github.com/TinyAGI/tinyagi/issues/283. As an immediate compensating control, restrict network access to the TinyAGI server so the agents route is not reachable from untrusted networks; placing the service behind a VPN or firewall eliminates the remote attack vector with no application-level trade-offs. If public exposure is required, deploy a reverse proxy with mandatory authentication in front of the agents endpoint to require credentials before requests reach buildSystemPrompt - this converts the exploitation profile from PR:N to PR:L at minimum, significantly raising the bar. Avoid exposing sensitive files such as .env, configuration files, or API key stores in directories reachable by the server process. Monitor VulDB at https://vuldb.com/vuln/386404 and the GitHub repository https://github.com/TinyAGI/tinyagi/ for patch availability.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today