https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-11T06:37:15.279304+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-87008 fkie_cve-2026-87008 2026-11-11T06:37:15.280550+00:00

Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.589, AstGrepService in codebase_rag/tools/ast_grep_service.py enumerates files beneath project_root and relies on should_skip_path in codebase_rag/utils/path_utils.py to classify them, but the containment check operates on unresolved lexical paths. A symbolic link planted inside an analyzed repository can therefore reference a file outside the configured root while still appearing in scope. The structural_search tool follows the link and discloses readable content without an approval gate, while structural_replace with dry_run=False follows it and overwrites writable content; the MCP path invokes structural replacement without the agent-loop approval control. An attacker who causes a victim to analyze a repository containing such a link can read credentials, keys, environment files, or sibling source and can modify files accessible to the code-graph-rag process. This issue is fixed in version 0.0.589.

 https://db.gcve.eu/vuln/ghsa-85gg-2gfq-q95m GHSA-85gg-2gfq-q95m — Code Graph RAG structural tools follow out-of-root symlinks 2026-11-11T06:37:15.280629+00:00

Affected: PyPI: code-graph-rag

A remote/local attacker who can get a symbolic link included in a source-code repository that code-graph-rag analyzes can cause the `structural_search` and `structural_replace` tools (backed by `AstGrepService`, exposed both as MCP tools and as agentic AI tools) to read and -- via `structural_replace` with `dry_run=False` -- overwrite arbitrary files outside the configured project root, because the tool's path-containment check (`should_skip_path`/`_classify_file`) is performed lexically on the unresolved path and never checks `Path.is_symlink()` or calls `.resolve()`, unlike the project's own (correct) `validate_project_path` decorator used elsewhere.

Tested at commit `90a3ed3cbdc7d3bb8036985b851cc7c9a3ba9c57` (pyproject version 0.0.550), current `main` at test time. Confirmed this commit already contains the fix for the prior advisory (GHSA-vvr2-h2jp-838m: paginated `read_file` path traversal) and the newer HTTP-MCP bearer-auth gate (`_validate_http_exposure` in `codebase_rag/mcp/server.py`) -- this is a distinct, still-open issue on top of those fixes, in a different component with a different root cause and a strictly worse impact (write, not just read).

## Details

`AstGrepService` (`codebase_rag/tools/ast_grep_service.py`) backs both the `structural_search` and `structural_replace` MCP/agentic tools. It enumerates candidate files with `os.walk()` and gates each path only through `should_skip_path()`:

- `codebase_rag/tools/ast_grep_service.py:84-109` (`_iter_source_f…