What happened
The FileArtifactService in Google ADK TypeScript (@google/adk) 0.4.0 before 0.6.0 does not sanitize relative or percent-encoded path traversal sequences (../, ..%2F) in the userId or sessionId parameters. When the ADK API server is deployed with this non-default artifact backend, a remote unauthenticated attacker can read files matching the artifact directory layout or write files outside the intended artifact storage root when an agent tool invokes saveArtifact.
Why it matters
The ADK is Google's official agent development kit; an agent artifact store is precisely where agent tools persist generated files, code, and retrieved documents. A traversal here lets an unauthenticated caller reach server files outside the artifact root or plant files that an agent later picks up — a real path for data disclosure and indirect content poisoning in agent workflows.
Attack vector
Unauthenticated crafted userId/sessionId path-traversal against the ADK API server artifact endpoints
Affected systems
@google/adk (Google ADK TypeScript) 0.4.0 up to but excluding 0.6.0, when FileArtifactService (non-default) is enabled
Mitigation
Upgrade to @google/adk 0.6.0 or later (fix commits 710b4ebe / 8c0eaa16 in adk-js)