{"id":"CVE-2026-105772","kind":"vulnerability","aliases":["CVE-2026-105772"],"related":[],"title":"Google ADK TypeScript: path traversal lets remote users read and write files","description":"Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to read files matching the artifact directory layout or write files (when an agent tool invokes saveArtifact) outside the intended artifact storage root via crafted relative or percent-encoded path traversal sequences (such as ../ or ..%2F) in the userId or sessionId parameters when the ADK API server is exposed with the non-default FileArtifactService enabled. Applications using the default InMemoryArtifactService are unaffected. Upgrade to @google/adk version 0.6.0 or later.","summary":"The FileArtifactService in the @google/adk TypeScript package does not block ../ or %2F sequences in userId or sessionId, so a remote unauthenticated attacker can read files in the artifact layout and write files outside the artifact root when an agent tool calls saveArtifact. Applications using the default InMemoryArtifactService are not affected.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["agents","ai-agents","ai-tooling","google-adk","node","typescript"],"not_affected_if":["default-config","in-memory-artifact-service"],"how_to_check":"Check the installed @google/adk version in package.json or the lockfile; affected versions are 0.4.0 before 0.6.0.\nCheck whether the ADK API server uses FileArtifactService rather than the default InMemoryArtifactService.","fix":"Upgrade @google/adk to 0.6.0 or later.\nIf you cannot upgrade, switch to InMemoryArtifactService or do not expose the ADK API server.","status":"open","published_at":"2026-10-20T18:17:16+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-23T22:39:25+00:00","updated_at":"2026-10-23T22:39:25+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-23T22:39:25Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade @google/adk to 0.6.0 or later.\nIf you cannot upgrade, switch to InMemoryArtifactService or do not expose the ADK API server.","reach":"internet","title":"Google ADK TypeScript: path traversal lets remote users read and write files","impact":"high","summary":"The FileArtifactService in the @google/adk TypeScript package does not block ../ or %2F sequences in userId or sessionId, so a remote unauthenticated attacker can read files in the artifact layout and write files outside the artifact root when an agent tool calls saveArtifact. Applications using the default InMemoryArtifactService are not affected.","category":"ai-tooling","who_cares":["google-adk","node","typescript","ai-agents"],"confidence":0.8,"needs_auth":"no","worst_case":"Remote attacker reads or writes files outside the artifact storage root","analyst_note":"Confirm the exact affected version range and whether the ADK API server is reachable from the internet in typical deployments; check the NVD entry and the upstream advisory for the 0.6.0 fix.","how_to_check":"Check the installed @google/adk version in package.json or the lockfile; affected versions are 0.4.0 before 0.6.0.\nCheck whether the ADK API server uses FileArtifactService rather than the default InMemoryArtifactService.\nunknown","needs_analyst":true,"not_affected_if":["default-config","in-memory-artifact-service"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000577,"input_tokens":3079,"output_tokens":539,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-105772':15A,18A '-2026':14A,17A '-22':84C '0.4.0':93C '0.6.0':95C,169C '2f':42B,137C 'adk':2A,28B,89C,146C 'affect':80B 'agent':19B,22B,69B,114C 'ai':21B,24B 'ai-ag':20B 'ai-tool':23B 'allow':96C 'api':147C 'applic':73B,158C 'artifact':58B,65B,106C,121C 'attack':52B,100C 'block':40B 'call':71B 'craft':125C 'cve':13A,16A 'cwe':83C 'default':76B,155C,161C 'directori':107C 'enabl':157C 'encod':130C 'expos':150C 'file':12A,55B,62B,103C,111C 'fileartifactservic':32B,86C,156C 'googl':1A,27B,88C 'google-adk':26B 'google/adk':35B,91C,167C 'inmemoryartifactservic':77B,162C 'intend':120C 'invok':116C 'later':171C 'layout':59B,108C 'let':6A 'match':104C 'node':29B 'non':154C 'non-default':153C 'outsid':63B,118C 'packag':37B 'paramet':143C 'path':4A,81C,131C 'percent':129C 'percent-encod':128C 'read':9A,54B,102C 'relat':126C 'remot':7A,50B,98C 'root':66B,123C 'saveartifact':72B,117C 'sequenc':43B,133C 'server':148C 'sessionid':47B,142C 'storag':122C 'tool':25B,70B,115C 'travers':5A,82C,132C 'typescript':3A,30B,36B,90C 'unaffect':164C 'unauthent':51B,99C 'upgrad':165C 'use':74B,159C 'user':8A 'userid':45B,140C 'version':92C,168C 'via':124C 'write':11A,61B,110C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T18:17:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-coordination@google.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105772","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105772","severity":null,"published_at":"2026-10-20T18:17:16+00:00","modified_at":"2026-10-20T20:06:37+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}