EUVD-2026-117781

Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.589, AstGrepService in codebaserag/tools/astgrepservice.py enumerates files beneath projectroot and relies on shouldskippath in...

CVE-2026-87008 Code Graph RAG structural tools follow out-of-root symlinks

Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.589, AstGrepService in codebaserag/tools/astgrepservice.py enumerates files beneath projectroot and relies on shouldskippath in...

CVE-2026-87008

The Code Graph RAG system (prior to version 0.0.589 ) is vulnerable to a path traversal issue where structural tools follow out-of-root symlinks . The root cause is that AstGrepService in codebase_rag/tools/ast_grep_service.py performs containment checks on unresolved lexical paths via should_ski...

code-graph-rag-PoC

code-graph-rag: security advisory CVE status: requested...