Is there a public PoC exploit available for CVE-2026-19019?

Yes, a public proof-of-concept exploit is available for CVE-2026-19019. Prioritise patching immediately. EPSS: 0.3%.

poco-agent CVE-2026-19019

Q: What is the CVSS score of CVE-2026-19019?

CVE-2026-19019 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-53818 LOW

Incomplete Cleanup (CWE-459)

2026-08-06 VulDB

GHSA-j255-r942-27q8

Information Disclosure Poco Agent Poco Ai

2.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.9 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.8 MEDIUM

Network-reachable trigger with high complexity; no confidentiality impact; low integrity and availability loss bounded to the running user's ~/.claude directory.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 06, 2026 - 08:31 vuln.today

Analysis Generated

Aug 06, 2026 - 08:31 vuln.today

Severity Changed

Aug 06, 2026 - 08:22 NVD

MEDIUM LOW

CVSS changed

Aug 06, 2026 - 08:22 NVD

6.3 (MEDIUM) 2.9 (LOW)

CVE Published

Aug 06, 2026 - 07:30 cve.org

LOW 2.9

DescriptionCVE.org

A security flaw has been discovered in poco-ai poco-agent up to 0.5.4. Affected is the function WorkspaceManager._setup_session_persistence of the file executor/app/core/workspace.py of the component Claude File Handler. The manipulation results in incomplete cleanup. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks.

AnalysisAI

Incomplete session cleanup in poco-ai/poco-agent up to version 0.5.4 can permanently destroy the host user's ~/.claude directory - including all Claude Code chat history stored under ~/.claude/projects - when the agent runs outside a container environment. The WorkspaceManager._setup_session_persistence method performs an unconditional rmtree followed by a symlink swap on ~/.claude without verifying a container context, and the corresponding cleanup phase can additionally unlink pre-existing ~/.claude symlinks unrelated to poco-agent. A publicly available exploit exists via GitHub issue #131 and PR #132, though the CVSS 4.0 base score of 2.9 reflects high attack complexity and impact limited to low integrity and availability loss with no confidentiality breach.

Technical ContextAI

The vulnerability resides in the WorkspaceManager class within executor/app/core/workspace.py of the poco-ai/poco-agent project (CPE: cpe:2.3:a:poco-ai:poco-agent:*:*:*:*:*:*:*:*). The _setup_session_persistence method was designed to atomically redirect Claude Code's ~/.claude directory to a workspace-scoped persistent storage area (.claude_data) using a symlink swap - a technique appropriate only inside disposable container environments where ~/.claude holds no real user data. CWE-459 (Incomplete Cleanup) manifests in two places: first, the setup phase invoked rmtree on the real ~/.claude directory and replaced it with a symlink without first confirming a container context (via /.dockerenv, /run/.containerenv, cgroup markers, or explicit env vars), meaning host-deployed instances would silently destroy live user data; second, the cleanup/teardown phase unlinked any ~/.claude symlink regardless of whether poco-agent created it, risking removal of pre-existing user-managed symlinks. The PR #132 fix introduces a _destructive_claude_symlink_allowed() guard and a targeted cleanup that only removes symlinks verifiably pointing at poco-agent's own persistent_claude_data path.

RemediationAI

An upstream fix is available via GitHub PR #132 at https://github.com/poco-ai/poco-claw/pull/132; a formally tagged patched release version has not been independently confirmed from the available data, so users should verify the fix is included in any release they consume. The patch adds the _destructive_claude_symlink_allowed() guard that refuses to perform the destructive rmtree and symlink swap unless a container environment is positively confirmed via /.dockerenv, /run/.containerenv, cgroup patterns (docker, containerd, kubepods, lxc), or the explicit environment variable POCO_IN_CONTAINER=1. As an immediate workaround, run poco-agent exclusively inside Docker or OCI containers where ~/.claude is ephemeral and not backed by real user data. Users on affected versions running poco-agent on host machines should back up ~/.claude before executing any tasks, and should avoid setting POCO_FORCE_CLAUDE_SYMLINK=1 outside of isolated container environments. The cleanup fix ensures symlink removal is scoped only to symlinks poco-agent itself created, preventing accidental destruction of pre-existing user configurations.