Google ADK TypeScript EUVD-2026-105224

Exploitable only when the operator has (1) explicitly selected the non-default FileArtifactService (the default InMemoryArtifactService is NOT vulnerable) and (2) exposed the ADK API server to attacker-reachable network traffic, on @google/adk versions 0.4.0 through 0.5.x (fixed in 0.6.0). The condition that limits exploitation is captured by CVSS 4.0 AT:P: the vulnerable file-backed artifact store must be enabled. Read access requires only a crafted userId/sessionId traversal sequence; the write primitive additionally requires that an agent tool path invokes saveArtifact, so arbitrary file write is contingent on that code path being reachable. No user interaction or authentication is required (PR:N/UI:N).

Multiple signals converge on genuine high severity but with an important real-world caveat. CVSS 4.0 is 9.1 (AV:N/AC:L/AT:P/PR:N/UI:N) indicating a remote, low-complexity, unauthenticated attack with high confidentiality and integrity impact - the AT:P (attack requirements present) metric correctly reflects that exploitation is gated on a non-default deployment condition rather than being universally reachable. The patch is confirmed available (PR #210 and commits from Google's own repo), and the fix adds input validation (SAFE_SEGMENT_RE) plus a defence-in-depth canonical-path check (assertInsideRoot), which independently corroborates the path-traversal mechanism described. Exploitation status is 'no public exploit identified at time of analysis' - no KEV listing and no POC flag were provided; the traversal payloads in the committed regression tests (../../etc, ..%2F..%2Fetc) demonstrate the technique but are test fixtures, not a weaponized exploit, and must not be conflated with active exploitation. No EPSS score was supplied, so widespread-exploitation probability cannot be quantified. The decisive mitigating factor: the vulnerability only affects deployments that have explicitly enabled the non-default FileArtifactService AND exposed the ADK API server; the default InMemoryArtifactService is unaffected. Net: a real priority for the subset of operators running the file-backed artifact store on an exposed server, but the conditional (AT:P) requirement meaningfully narrows the exploitable population relative to the raw 9.1 score.

An attacker reaches a network-exposed ADK API server that has been configured with the non-default FileArtifactService and supplies a userId or sessionId value containing relative or percent-encoded traversal sequences (../ or ..%2F). Because CVSS is PR:N, no authentication is required; the crafted identifier lets the attacker read files matching the artifact directory layout, and when an agent tool invokes saveArtifact, write files outside the intended storage root. No public exploit is identified at time of analysis, though the vendor's regression tests illustrate the exact traversal payloads.