Description

Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.345, the MCPToolsRegistry.read_file implementation in codebase_rag/mcp/tools.py joins attacker-controlled file_path input to project_root without resolving and verifying containment when offset or limit selects the paginated branch. An absolute path causes pathlib to discard the configured root, while relative traversal can also resolve outside it. The protected non-paginated branch uses validate_project_path, but the paginated branch bypasses that validation before opening the path. An unauthenticated caller of a network-exposed HTTP MCP server can therefore read arbitrary UTF-8-readable files available to the server process, including credentials, environment data, private keys, source, and configuration; local callers through the stdio transport can reach the same vulnerable code path. This issue is fixed in version 0.0.345.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-11-05T20:18:00.017Z",
  "pubdate": "2026-11-05T20:18:00.017Z",
  "executiveSummary": "A critical path traversal vulnerability exists in the MCPToolsRegistry.read_file function within the codebase_rag package, affecting versions prior to 0.0.345.\nThe vulnerability arises from improper input validation and path sanitization when processing paginated read requests, allowing unauthorized access to arbitrary files on the host filesystem.\nAn attacker, whether unauthenticated via a network-exposed HTTP MCP server or a local actor using stdio transport, can bypass path containment restrictions.\nSuccessful exploitation results in the unauthorized disclosure of sensitive information, including environment variables, private keys, configuration files, and proprietary source code.\nThis flaw presents a severe security risk as the application fails to verify that the requested file resides within the defined project_root directory when specific pagination parameters are utilized.\nThe vulnerability is remediated in version 0.0.345, which ensures all file access operations undergo consistent security validation regardless of pagination state.",
  "technicalDetails": "The vulnerability is located in codebase_rag/mcp/tools.py within the MCPToolsRegistry.read_file method. The root cause is a deficiency in path validation logic specifically within the paginated branch of the file-reading routine.\nWhen a request specifies an offset or limit for pagination, the application enters a branch that fails to invoke the validate_project_path function. This function is correctly utilized in the non-paginated code path to ensure the requested path is contained within the project_root.\nBecause the paginated branch performs a direct join between project_root and the attacker-controlled file_path, the application is susceptible to directory traversal attacks. In Python's pathlib library, providing an absolute path as the second argument to the join operator causes the library to discard the base path (project_root) and treat the input as an absolute path, effectively breaking out of the designated directory sandbox.\nFurthermore, even without absolute paths, the implementation fails to resolve symbolic links or normalize '../' sequences, allowing for relative path traversal. An attacker can supply crafted file paths, such as '../../../../etc/passwd' or similar, to traverse the filesystem hierarchy outside the scope of the project root.\nThe attack flow proceeds as follows: 1) The attacker initiates an MCP request to the read_file tool. 2) The attacker includes pagination parameters (offset or limit) to trigger the vulnerable code branch. 3) The attacker provides a malicious string for the file_path parameter containing traversal sequences or an absolute path. 4) The application incorrectly processes the path without invoking security constraints. 5) The server process opens the targeted file and returns its contents (UTF-8 encoded) to the attacker.\nThis vulnerability is reachable via both network-exposed HTTP MCP servers and local stdio transport mechanisms. No prior authentication is required to interact with the vulnerable endpoint, granting an attacker the ability to read any file for which the server process user has read permissions. The impact is significant, as it facilitates the exfiltration of credentials, API keys, and sensitive configuration data often found in project environments, leading to potential full system compromise or lateral movement within the infrastructure."
}