Description

Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.589, AstGrepService in codebase_rag/tools/ast_grep_service.py enumerates files beneath project_root and relies on should_skip_path in codebase_rag/utils/path_utils.py to classify them, but the containment check operates on unresolved lexical paths. A symbolic link planted inside an analyzed repository can therefore reference a file outside the configured root while still appearing in scope. The structural_search tool follows the link and discloses readable content without an approval gate, while structural_replace with dry_run=False follows it and overwrites writable content; the MCP path invokes structural replacement without the agent-loop approval control. An attacker who causes a victim to analyze a repository containing such a link can read credentials, keys, environment files, or sibling source and can modify files accessible to the code-graph-rag process. This issue is fixed in version 0.0.589.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-11-05T21:18:54.370Z",
  "pubdate": "2026-11-05T21:18:54.370Z",
  "executiveSummary": "Code Graph RAG versions prior to 0.0.589 are vulnerable to a critical path traversal and arbitrary file read/write vulnerability. The vulnerability arises from improper handling of symbolic links when processing project repositories, allowing the tool to bypass intended directory constraints.\nThe flaw exists within the AstGrepService component, which incorrectly validates path boundaries using unresolved lexical paths. By planting a malicious symbolic link within a targeted repository, an attacker can trick the service into accessing, reading, or modifying files outside of the defined project root.\nThe impact is severe: successful exploitation allows unauthorized disclosure of sensitive information—such as environment variables, private keys, and source code—and enables unauthorized file modification. Because the MCP path executes structural replacements without manual agent-loop approval, the risk of automated, high-impact data corruption is significant.\nThis vulnerability is exploited by convincing a user or system to run Code Graph RAG against a compromised or malicious repository containing engineered symbolic links. No authentication is required beyond the ability to influence the target's repository analysis path.",
  "technicalDetails": "The root cause of this vulnerability is the implementation of path containment logic in codebase_rag/utils/path_utils.py, specifically within the should_skip_path function. The validation mechanism relies exclusively on unresolved lexical paths. Consequently, it fails to account for file system-level resolution, where symbolic links can resolve to locations outside the intended project_root.\nThe vulnerable component, AstGrepService located in codebase_rag/tools/ast_grep_service.py, performs directory traversal during the file enumeration phase. When the service encounters a symbolic link that points to a restricted directory (e.g., /etc/, ~/.ssh/, or sibling repositories), the lexical containment check reports the path as valid because it does not resolve the link's target destination.\nThe attack flow proceeds as follows: 1) An attacker creates a repository and inserts a symbolic link that points to a sensitive file or directory on the host machine. 2) The attacker induces the victim to analyze this repository using Code Graph RAG. 3) The AstGrepService enumerates the repository files, processes the symbolic link as a legitimate file within the root, and bypasses the should_skip_path gate. 4) The structural_search tool retrieves and exposes the content of the linked file without requiring additional authorization. 5) If using the MCP path, the structural_replace tool executes with dry_run=False, allowing the attacker to overwrite target files with arbitrary content.\nThis vulnerability is exacerbated by the absence of an approval gate in the MCP path for structural replacement operations. Since the agent-loop logic is bypassed, the tool executes replacements immediately, facilitating automated exploitation of sensitive configuration files or source code. The vulnerability affects all versions of Code Graph RAG prior to 0.0.589. The exploitation does not require specific network exposure, as it is inherently tied to the local file system access permissions of the process executing the Code Graph RAG instance."
}