Jondachen

**Name of the Vulnerable Software and Affected Versions** TinyAGI version 0.0.20 **Description** A remote file inclusion issue exists within the Message API Endpoint component. The flaw is located in the `collectFiles()` function within the `packages/core/src/response.ts` file, allowing an attacker to remotely include files. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider disabling the `collectFiles()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** TinyAGI version 0.0.20 **Description** A remote attack can be launched against the Message API Endpoint due to missing authorization. The issue resides in the `processMessage()` function within the `packages/main/src/index.ts` file. **Recommendations** As a temporary workaround, consider restricting access to the `processMessage()` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** TinyAGI version 0.0.20 **Description** A remote file inclusion issue exists in the `buildSystemPrompt()` function within the `packages/server/src/routes/agents.ts` file. This allows a remote attacker to include arbitrary files through manipulation of the input. **Recommendations** As a temporary workaround, consider restricting the use of the `buildSystemPrompt()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** poco-ai poco-agent versions prior to 0.5.5 **Description** A security flaw exists in the Claude File Handler component within the `WorkspaceManager. setup session persistence()` function located in the executor/app/core/workspace.py file. Remote manipulation of this function can lead to incomplete cleanup. This issue is characterized by high complexity and difficult exploitability. **Recommendations** Update poco-ai poco-agent to version 0.5.5 or later. As a temporary mitigation, restrict access to the `WorkspaceManager. setup session persistence()` function.