CVE-2026-87008

Name of the Vulnerable Software and Affected Versions Code Graph RAG versions prior to 0.0.589

Description AstGrepService in codebase rag/tools/ast grep service.py enumerates files beneath project root and uses should skip path in codebase rag/utils/path utils.py for classification. However, the containment check uses unresolved lexical paths, allowing a symbolic link within an analyzed repository to reference files outside the configured root. Consequently, the structural search tool can disclose readable content without approval, and structural replace with dry run=False can overwrite writable content. Additionally, the MCP path allows structural replacement without agent-loop approval control. An attacker can exploit this by inducing a victim to analyze a repository containing such a link to read sensitive data like credentials and environment files, or modify files accessible to the process.

Recommendations Update to version 0.0.589.