Description

CodeRAG is a lightweight semantic code search and distillation utility for AI coding agents. Prior to 1.3.1, the default agent-coderag sync flow in code_rag/entry/cli.py calls sync_dependencies for an indexed path, and code_rag/core/manager.py treats build.gradle or build.gradle.kts as sufficient to invoke _sync_gradle. _sync_gradle prefers a repository-controlled gradlew or gradlew.bat file and passes it directly to asyncio.create_subprocess_exec with the repository root as the working directory; validate_path in code_rag/core/utils.py constrains the directory location but does not validate the executable's content or integrity. A victim who indexes an attacker-controlled Gradle repository therefore executes attacker-supplied code with the victim's operating-system privileges, allowing disclosure, modification, persistence, or denial of service in the user environment. This issue is fixed in 1.3.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-09-15T15:17:19.270Z",
  "pubdate": "2026-09-15T15:17:19.270Z",
  "executiveSummary": "CodeRAG versions prior to 1.3.1 are susceptible to an arbitrary command execution vulnerability stemming from insecure handling of project build files.\nThe vulnerability occurs because the application automatically invokes repository-provided Gradle wrappers without validating the integrity or content of the executable.\nAn attacker can exploit this by enticing a victim to index a malicious repository containing a crafted build.gradle or build.gradle.kts file alongside a modified gradlew or gradlew.bat script.\nSuccessful exploitation results in remote code execution with the privileges of the user running the CodeRAG utility, potentially leading to unauthorized data disclosure, system modification, persistence, or denial of service.\nThe impact is significant as it leverages the trust placed in local build tools to execute arbitrary system commands within the host environment.\nExploitation is trivial if an attacker convinces a user to sync an attacker-controlled code base.",
  "technicalDetails": "The vulnerability resides within the project's dependency synchronization logic, specifically in how the application manages Gradle build environments.\nIn versions prior to 1.3.1, the file code_rag/entry/cli.py invokes sync_dependencies upon indexing a directory. When the code_rag/core/manager.py component detects the presence of build.gradle or build.gradle.kts files, it triggers the _sync_gradle function to handle project dependencies.\nThe _sync_gradle function is architected to prefer the execution of a project-specific gradlew (Linux/macOS) or gradlew.bat (Windows) wrapper script found within the repository's root directory. The function passes the path of these scripts directly to asyncio.create_subprocess_exec without any sanitization or cryptographic verification of the script's content.\nWhile the code_rag/core/utils.py module includes a validate_path function intended to constrain the working directory, this function focuses exclusively on path traversal prevention and fails to validate the integrity or the provenance of the executable files themselves.\nThe attack flow proceeds as follows: 1) An attacker creates a repository containing a malicious gradlew or gradlew.bat file designed to execute arbitrary shell commands. 2) The attacker publishes this repository or directs a victim to index it via CodeRAG. 3) The victim uses CodeRAG to sync the project. 4) CodeRAG identifies the build files and triggers _sync_gradle. 5) The system executes the malicious wrapper script using the victim's OS-level privileges.\nBecause the execution occurs with the victim's current user privileges, the attacker gains the ability to perform any action authorized to the user account, including exfiltrating sensitive local files, installing persistent backdoors, or executing system-wide disruptive commands.\nThere is no requirement for authentication within the application context, as the vulnerability is triggered by the indexing process itself. The system trusts the contents of the repository being indexed, turning a utility designed for code analysis into an unintended vector for arbitrary code execution."
}