External risk intelligence

ADK TypeScript Path Traversal Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-105772

The vulnerability exists in a specific service (FileArtifactService) within the Google ADK TypeScript library. This service is not the default configuration, as applications typically use the InMemoryArtifactService. Because the vulnerable component requires non-default configuration to be enabled and exposed, public internet exposure is uncommon in standard deployments.

Path Traversal

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A path traversal vulnerability exists in a specific component of the Google ADK TypeScript library, affecting how files are handled. This could allow unauthorized access to read or write files outside of intended storage areas if a non-default configuration is in use. The primary concern is to confirm if this specific, non-default service is enabled within your environment.

Allows unauthorized file access if a specific service is enabled.
Confirms if a non-default file handling service is active.
Understand exposure by confirming service configuration.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could reach the vulnerable FileArtifactService if it's enabled instead of the default service, by sending specially crafted path traversal sequences in the userId or sessionId parameters to the ADK API server. This could allow them to read or write files outside the intended storage location.

Remote, unauthenticated entry.
Crafted path traversal in parameters.
Unauthorized file access or modification.

Live Threat

Current exploitation, exposure, and threat context

When the non-default FileArtifactService is enabled in the Google ADK TypeScript API server, a remote, unauthenticated attacker could read files that match the artifact directory structure or write files outside the intended storage location. This is possible by sending crafted path traversal sequences in the userId or sessionId parameters. Applications using the default InMemoryArtifactService are not affected.

Sensitive files on the server could be read.
Attacker sends crafted path traversal sequences.
Unauthorized file access and potential modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

The technical leader or application owner responsible for services utilizing the Google ADK TypeScript library should take the lead in addressing this vulnerability. The immediate first step is to confirm if the `FileArtifactService` is enabled and exposed, then identify any affected instances, assess their reachability and criticality, and finally plan remediation based on these findings.

Application owners should investigate usage.
Verify `FileArtifactService` configuration status.
Plan remediation based on exposure and risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Google ADK TypeScript library used for?

The @google/adk package provides tools for building applications, specifically facilitating how those applications manage, store, and interact with artifacts—the data files generated during task execution. It includes different services for handling this data, such as in-memory storage for temporary tasks or file-based storage for more persistent needs.

What is the vulnerability class for CVE-2026-105772?

This vulnerability is classified as Path Traversal (CWE-22). It means the software does not properly sanitize user-supplied input, allowing an attacker to use special characters like dots and slashes to break out of the intended directory. In this case, an attacker can manipulate specific parameters to access or overwrite files on the server that should be off-limits.

Does this issue affect all Google ADK TypeScript applications?

No. The vulnerability only triggers if the non-default FileArtifactService is explicitly enabled in the ADK API server. Applications that use the default InMemoryArtifactService are not impacted because they do not utilize the vulnerable file system handling logic that allows these traversal sequences.

How do I know if my systems are at risk?

According to Halo Surface Signal, this vulnerability is unlikely to affect standard deployments because the vulnerable service is not the default. You should verify if your application configuration specifically enables FileArtifactService. If the service is not active, the attack vector is closed regardless of your internet exposure.

How can I remediate CVE-2026-105772?

The primary step is to check your application code to determine if FileArtifactService is currently in use. If it is, the recommended action is to upgrade the @google/adk library to version 0.6.0 or later, which contains the necessary security fixes to prevent unauthorized file access via path traversal sequences.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.