A file inclusion vulnerability has been identified in TinyAGI version 0.0.20, specifically in the collectFiles function within packages/core/src/response.ts at the Message API Endpoint. The flaw allows remote attackers to exploit file inclusion through manipulation of the affected function. A public exploit is already available, increasing the risk of active attacks. The vulnerability was responsibly disclosed to the project maintainers via a GitHub issue, but no response or patch has been provided yet. The issue is tracked as CVE-2026-19009 and is listed on NVD and VulDB. The remote exploitability and public availability of the exploit make this a high-severity concern. Users of TinyAGI 0.0.20 are advised to monitor for patches or consider mitigations.