CVE-2026-77604

Prior to version 0.0.345 , Code Graph RAG is vulnerable to arbitrary file read via a path traversal flaw in the MCPToolsRegistry.read_file implementation located in codebase_rag/mcp/tools.py. The root cause is that the paginated branch of the code joins attacker-controlled file_path input to proj...