CVE-2026-87008 in Code Graph RAG
Summary
by MITRE • 11/05/2026
Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.589, AstGrepService in codebase_rag/tools/ast_grep_service.py enumerates files beneath project_root and relies on should_skip_path in codebase_rag/utils/path_utils.py to classify them, but the containment check operates on unresolved lexical paths. A symbolic link planted inside an analyzed repository can therefore reference a file outside the configured root while still appearing in scope. The structural_search tool follows the link and discloses readable content without an approval gate, while structural_replace with dry_run=False follows it and overwrites writable content; the MCP path invokes structural replacement without the agent-loop approval control. An attacker who causes a victim to analyze a repository containing such a link can read credentials, keys, environment files, or sibling source and can modify files accessible to the code-graph-rag process. This issue is fixed in version 0.0.589.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in Code Graph RAG prior to version 0.0.589 represents a critical path traversal flaw rooted in improper handling of symbolic links during repository analysis. The system utilizes an AstGrepService component, located within the ast_grep_service.py module, which is responsible for enumerating files beneath a specified project root directory. To filter out irrelevant or sensitive directories, this service relies on a containment check implemented via the should_skip_path function in path_utils.py. However, the fundamental technical flaw lies in the fact that this containment operation operates exclusively on unresolved lexical paths rather than canonicalized file system paths. In Unix-like operating systems and many other environments, symbolic links serve as pointers to target files or directories, potentially pointing outside the intended scope of analysis if not resolved correctly before comparison. By failing to resolve these symlinks into their absolute physical locations prior to performing containment checks, the application allows an attacker to craft a repository structure where a symlink appears to reside within the project root but actually points to arbitrary locations on the host file system.
This architectural oversight leads directly to unauthorized information disclosure and potential remote code execution or configuration tampering depending on the tool invoked by the AI agent. When the structural_search tool is executed, it follows these symbolic links without implementing any additional approval gate or security boundary check beyond the flawed lexical containment logic. Consequently, an attacker who can induce a victim user to analyze a maliciously constructed repository containing such symlinks can cause the system to read and return the contents of files located outside the designated project root. This exposure is particularly severe as it often includes sensitive artifacts such as environment variable files (.env), SSH keys, API credentials, database connection strings, or source code from sibling projects that were never intended to be part of the analysis scope. The lack of an approval gate means this data exfiltration occurs automatically during standard query operations without requiring explicit user consent for accessing external resources.
Beyond information disclosure, the vulnerability extends into a critical integrity violation through the structural_replace tool and its interaction with the Model Context Protocol (MCP). When structural_replace is invoked with dry_run set to False, it follows symbolic links in the same manner as search but proceeds to overwrite writable content at the target location of the link. This capability allows an attacker to modify files outside the project root that are accessible by the user account running the code-graph-rag process. The severity is further amplified when considering the MCP path invocation, which triggers structural replacement without engaging the agent-loop approval control mechanism typically designed to prevent unintended side effects from AI-generated edits. This absence of a final safety check means that maliciously crafted prompts or repository structures can lead to direct file system modification in arbitrary directories, potentially overwriting critical configuration files, scripts, or application binaries with attacker-controlled content.
From a threat modeling perspective, this vulnerability aligns closely with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, as the application fails to restrict access to resources outside the intended directory boundary due to insufficient path canonicalization. It also relates to CWE-732: Incorrect Permission Assignment for Critical Resource, given that sensitive files are exposed without adequate access controls relative to their actual location versus logical scope. In terms of MITRE ATT&CK mapping, this behavior corresponds to T1083: File and Directory Discovery, where the attacker uses the application as a tool to enumerate and read restricted data, and potentially T1564: Hidden Files and Directories if symlinks are used obliquely, or T1222: File Permission Modification when write operations are exploited. The attack vector typically involves social engineering or supply chain compromise where an attacker convinces a developer or automated system to analyze a repository containing the malicious symlink structure.
The operational impact of this vulnerability is significant for organizations relying on Code Graph RAG for codebase understanding, refactoring assistance, and security auditing. Unauthorized access to credentials stored in environment files can lead to broader infrastructure compromise if those keys are reused across services. Modification of external configuration files could disrupt service availability or introduce backdoors into systems outside the immediate development scope. Furthermore, because the vulnerability affects both read and write operations through different tool interfaces, it presents a dual threat profile that undermines trust in the AI agent's ability to safely interact with the local file system. The lack of an approval gate for search operations means data leakage can occur silently during routine queries, while the bypass of agent-loop controls for replacement operations allows for active sabotage or persistence mechanisms to be established by an attacker controlling the input repository.
To mitigate this vulnerability, it is imperative that all path containment checks utilize canonicalized absolute paths rather than raw lexical strings. The should_skip_path function must resolve symbolic links using system calls such as os.path.realpath in Python before performing any directory boundary comparisons. Additionally, strict allow-listing of permitted directories for both read and write operations should be enforced at the file I/O layer, ensuring that even if a symlink is followed, the final resolved path remains within an approved set of locations. For tools like structural_replace, implementing mandatory user approval gates or sandboxed execution environments would prevent unintended modifications to critical system files. Upgrading to version 0.0.589 resolves this issue by addressing these fundamental flaws in path handling and access control logic. Organizations using earlier versions should immediately update their installations and audit any repositories analyzed during the vulnerable period for signs of data exfiltration or unauthorized file modifications.