CVE-2026-87008: Code Graph RAG structural tools follow out-of-root symlinks
Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.589, AstGrepService in codebaserag/tools/astgrepservice.py enumerates files beneath projectroot and relies on shouldskippath in codebaserag/utils/pathutils.py to classify them, but the containment check operates on unresolved lexical paths. A symbolic link planted inside an analyzed repository can therefore reference a file outside the configured root while still appearing in scope. The structuralsearch tool follows the link and discloses readable content without an approval gate, while structuralreplace with dryrun=False follows it and overwrites writable content; the MCP path invokes structural replacement without the agent-loop approval control. An attacker who causes a victim to analyze a repository containing such a link can read credentials, keys, environment files, or sibling source and can modify files accessible to the code-graph-rag process. This issue is fixed in version 0.0.589.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Code Graph RAGto a version that resolves this vulnerability.Fixed in 0.0.589
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running versions prior to 0.0.589 are exposed when they analyze a repository that contains a symbolic link pointing outside the configured project root. The impact is limited to files readable or writable by the code-graph-rag process.
What does an attacker need to exploit it?
The attacker needs to cause a victim to analyze a repository containing a planted out-of-root symbolic link. Exploitation also requires user interaction because a victim must analyze that repository.
Can this be used to modify files as well as read them?
Yes. structural_search can disclose readable content through the link, and structural_replace with dry_run=False can overwrite writable target files. The MCP path can invoke structural replacement without the agent-loop approval control.
What should be done if immediate patching is not possible?
Avoid analyzing untrusted repositories that may contain symbolic links, and ensure the code-graph-rag process cannot read or write sensitive files outside the intended project directory. Upgrading to version 0.0.589 fixes the issue.