Path Traversal Vulnerability in Google ADK TypeScript FileArtifactService
CVE-2026-105772

9.1CRITICAL

Key Information:

Vendor

Google
Status
Adk Typescript (@google/adk)
Vendor
CVE Published:
20 October 2026

What is CVE-2026-105772?

A path traversal vulnerability exists in the FileArtifactService of Google ADK TypeScript, allowing an unauthenticated remote attacker to manipulate file paths. By sending crafted relative or percent-encoded path traversal sequences, attackers can bypass security measures and either read sensitive files or write files outside the intended directory when the ADK API server is configured with the non-default FileArtifactService. This vulnerability affects versions 0.4.0 through 0.5.x, while those using the InMemoryArtifactService remain unaffected. Users are advised to upgrade to version 0.6.0 or later to mitigate this risk.

Affected Version(s)

ADK TypeScript (@google/adk) 0.4.0 < 0.6.0

References

https://github.com/google/adk-js/security/advisories/GHSA...
vendor-advisory
https://github.com/google/adk-js/pull/210
patchissue-tracking
https://github.com/google/adk-js/commit/8c0eaa160a43c1d79...
patch

CVSS V4

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gouri Sankar A (@g0w6y)
.