CVE-2026-57586

CodeRAG is a lightweight semantic code search and distillation utility for AI coding agents. Prior to 1.3.1, the default agent-coderag sync flow in coderag/entry/cli.py calls syncdependencies for an indexed path, and coderag/core/manager.py treats build.gradle or build.gradle.kts as sufficient to...

EUVD-2026-78583

CodeRAG is a lightweight semantic code search and distillation utility for AI coding agents. Prior to 1.3.1, the default agent-coderag sync flow in coderag/entry/cli.py calls syncdependencies for an indexed path, and coderag/core/manager.py treats build.gradle or build.gradle.kts as sufficient to...

CVE-2026-57586

CodeRAG (agent-coderag) prior to 1.3.1 contains an Arbitrary Code Execution vulnerability in its default sync flow. When a victim indexes a directory containing build.gradle or build.gradle.kts, the tool unconditionally prefers a repository-controlled gradlew wrapper and executes it via asyncio.c...

CVE-2026-57586 CodeRAG: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution

CodeRAG is a lightweight semantic code search and distillation utility for AI coding agents. Prior to 1.3.1, the default agent-coderag sync flow in coderag/entry/cli.py calls syncdependencies for an indexed path, and coderag/core/manager.py treats build.gradle or build.gradle.kts as sufficient to...

CVE-2026-57586 CodeRAG: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution

CodeRAG is a lightweight semantic code search and distillation utility for AI coding agents. Prior to 1.3.1, the default agent-coderag sync flow in coderag/entry/cli.py calls syncdependencies for an indexed path, and coderag/core/manager.py treats build.gradle or build.gradle.kts as sufficient to...

CVE-2026-57586 CodeRAG: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution

CodeRAG is a lightweight semantic code search and distillation utility for AI coding agents. Prior to 1.3.1, the default agent-coderag sync flow in coderag/entry/cli.py calls syncdependencies for an indexed path, and coderag/core/manager.py treats build.gradle or build.gradle.kts as sufficient to...

PT-2026-92029

CodeRAG is a lightweight semantic code search and distillation utility for AI coding agents. Prior to 1.3.1, the default agent-coderag sync flow in code rag/entry/cli.py calls sync dependencies for an indexed path, and code rag/core/manager.py treats build.gradle or build.gradle.kts as sufficient...

CVE-2026-57586: Improper Neutralization of Special Elements used in an OS Command

CodeRAG is a lightweight semantic code search and distillation utility for AI coding agents. Prior to 1.3.1, the default agent-coderag sync flow in coderag/entry/cli.py calls syncdependencies for an indexed path, and coderag/core/manager.py treats build.gradle or build.gradle.kts as sufficient to...