CVE-2026-77604

Name of the Vulnerable Software and Affected Versions Code Graph RAG versions prior to 0.0.345

Description The MCPToolsRegistry.read file() function in codebase rag/mcp/tools.py fails to properly resolve and verify the containment of the file path variable when the offset or limit parameters trigger the paginated branch. This allows an attacker to use absolute paths or relative traversal to bypass the validate project path validation and access files outside the intended project root. An unauthenticated caller via a network-exposed HTTP MCP server or a local caller via stdio transport can read arbitrary UTF-8-readable files accessible to the server process, such as private keys, credentials, and configuration files.

Recommendations Update to version 0.0.345.