fkie_cve-2026-77604

Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.345, the MCPToolsRegistry.read_file implementation in codebase_rag/mcp/tools.py joins attacker-controlled file_path input to project_root without resolving and verifying containment when offset or limit selects the paginated branch. An absolute path causes pathlib to discard the configured root, while relative traversal can also resolve outside it. The protected non-paginated branch uses validate_project_path, but the paginated branch bypasses that validation before opening the path. An unauthenticated caller of a network-exposed HTTP MCP server can therefore read arbitrary UTF-8-readable files available to the server process, including credentials, environment data, private keys, source, and configuration; local callers through the stdio transport can reach the same vulnerable code path. This issue is fixed in version 0.0.345.

GHSA-vvr2-h2jp-838m — Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read

Affected: PyPI: code-graph-rag

### Summary

The `read_file` MCP tool in `codebase_rag/mcp/tools.py` contains a path traversal vulnerability in its paginated branch (when `offset` or `limit` is supplied). The handler constructs a file path using `Path(self.project_root) / file_path` without subsequently validating that the resolved path remains within the configured project root. Python's `pathlib` silently discards the left-hand component when the right-hand argument is an absolute path, allowing an attacker to read any UTF-8-readable file on the server by passing an absolute path such as `/etc/passwd`.

### Details

**Vulnerable location:** `codebase_rag/mcp/tools.py:556–565` (`MCPToolsRegistry.read_file`)

The `read_file` MCP tool accepts three parameters: `file_path`, `offset`, and `limit`. When either `offset` or `limit` is present the handler takes a distinct code path:

```python # codebase_rag/mcp/tools.py:556-565 async def read_file( self, file_path: str, offset: int | None = None, limit: int | None = None ) -> str: logger.info(lg.MCP_READ_FILE.format(path=file_path, offset=offset, limit=limit)) try: if offset is not None or limit is not None: full_path = Path(self.project_root) / file_path # ← VULNERABLE LINE start = offset if offset is not None else 0

with open(full_path, encoding=cs.ENCODING_UTF8) as f: # ← SINK ```

Because `pathlib.Path.__truediv__` replaces the left operand entirely when the right operand is an absolute path, any…

Most recent entries from all

fkie_cve-2026-77604

GHSA-vvr2-h2jp-838m — Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read