CVE-2026-105772
9.1CriticalPublished 20 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-22
Impact
Remote unauthenticated attackers can read and write arbitrary files outside the artifact storage root if the ADK API server is exposed with FileArtifactService enabled. They only need network access to send crafted userId or sessionId parameters to the service.
Root cause
FileArtifactService fails to sanitize relative and percent-encoded directory traversal sequences in userId and sessionId parameters before resolving file paths.
Affected systems
Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 using FileArtifactService
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade @google/adk to version 0.6.0 or later. If upgrading immediately is not possible, switch back to the default InMemoryArtifactService or disable exposure of the ADK API server.
$ npm install @google/adk@^0.6.0AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to read files matching the artifact directory layout or write files (when an agent tool invokes saveArtifact) outside the intended artifact storage root via crafted relative or percent-encoded path traversal sequences (such as ../ or ..%2F) in the userId or sessionId parameters when the ADK API server is exposed with the non-default FileArtifactService enabled. Applications using the default InMemoryArtifactService are unaffected. Upgrade to @google/adk version 0.6.0 or later.