---
id: "CVE-2026-105772"
kind: "vulnerability"
aliases: ["CVE-2026-105772"]
title: "Google ADK TypeScript: path traversal lets remote users read and write files"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["agents", "ai-agents", "ai-tooling", "google-adk", "node", "typescript"]
not_affected_if: ["default-config", "in-memory-artifact-service"]
published_at: "2026-10-20T18:17:16+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-23T22:39:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105772", "first_seen_at": "2026-10-23T21:57:21+00:00"}]
---

# Google ADK TypeScript: path traversal lets remote users read and write files

The FileArtifactService in the @google/adk TypeScript package does not block ../ or %2F sequences in userId or sessionId, so a remote unauthenticated attacker can read files in the artifact layout and write files outside the artifact root when an agent tool calls saveArtifact. Applications using the default InMemoryArtifactService are not affected.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check the installed @google/adk version in package.json or the lockfile; affected versions are 0.4.0 before 0.6.0.
Check whether the ADK API server uses FileArtifactService rather than the default InMemoryArtifactService.

## Fix

Upgrade @google/adk to 0.6.0 or later.
If you cannot upgrade, switch to InMemoryArtifactService or do not expose the ADK API server.

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105772

## From the sources

Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to read files matching the artifact directory layout or write files (when an agent tool invokes saveArtifact) outside the intended artifact storage root via crafted relative or percent-encoded path traversal sequences (such as ../ or ..%2F) in the userId or sessionId parameters when the ADK API server is exposed with the non-default FileArtifactService enabled. Applications using the default InMemoryArtifactService are unaffected. Upgrade to @google/adk version 0.6.0 or later.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_