CVE-2026-19011 MEDIUM

CVE-2026-19011: TinyAGI agents.ts buildSystemPrompt file inclusion

Vendor N/A

Product TinyAGI

Weakness CWE-73

Published August 6, 2026

Last update August 6, 2026

View on NVD All CVEs

CVSS base score

6.9/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was detected in TinyAGI 0.0.20. The affected element is the function buildSystemPrompt of the file packages/server/src/routes/agents.ts. Performing a manipulation results in file inclusion. The attack may be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Key dates

02Disclosure timeline

August 6, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-19011 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/73.html AskarLabs — CWE-73 write-up External Control of File Name or Path

Related vulnerabilities

04Related CVE

CVE-2025-12137 Import WP – Export and Import CSV and XML files to WordPress <= 2.14.16 - Authenticated (Admin+) Arbitrary File Read CVE-2025-5393 Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.5 - Missing Authorization to Unauthenticated Arbitrary File Deletion CVE-2025-8422 Propovoice <= 1.7.6.7 - Unauthenticated Arbitrary File Read CVE-2024-7626 WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) <= 1.6.9 - Improper Path Validation to Authenticated (Subscriber+) Arbitrary File Move and Read CVE-2026-23898 Joomla! Core - [20260305] - Arbitrary file deletion in com_joomlaupdate