CVE-2026-87008

The Code Graph RAG system (prior to version 0.0.589 ) is vulnerable to a path traversal issue where structural tools follow out-of-root symlinks . The root cause is that AstGrepService in codebase_rag/tools/ast_grep_service.py performs containment checks on unresolved lexical paths via should_ski...

EUVD-2026-117781

Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.589, AstGrepService in codebaserag/tools/astgrepservice.py enumerates files beneath projectroot and relies on shouldskippath in...

CVE-2026-87008 Code Graph RAG structural tools follow out-of-root symlinks

Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.589, AstGrepService in codebaserag/tools/astgrepservice.py enumerates files beneath projectroot and relies on shouldskippath in...

CVE-2026-77604

Prior to version 0.0.345 , Code Graph RAG is vulnerable to arbitrary file read via a path traversal flaw in the MCPToolsRegistry.read_file implementation located in codebase_rag/mcp/tools.py. The root cause is that the paginated branch of the code joins attacker-controlled file_path input to proj...

code-graph-rag-PoC

code-graph-rag: security advisory CVE status: requested, pending assignment. This finding is published as GHSA-85gg-2gfq-q95m. On CVE assignment this repository is renamed CVE-YYYY-NNNNN-code-graph-rag-PoC and this banner is replaced with the CVE link. | ---|--- Researcher| Dostxodjayev Abdullox...

code-graph-rag-PoC

code-graph-rag: security advisory CVE status: requested...