CVE-2026-77604— Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read

Quick assessment

Affected

vitali87 code-graph-rag

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Code Graph RAG 是一个由 AI 驱动的知识图谱与检索系统，用于查询、理解和编辑多语言代码库。在 0.0.345 版本之前，中的实现，在通过或参数选择分页分支时，会将攻击者可控的输入与直接拼接，而未先解析并验证该路径是否包含在根目录内。若传入绝对路径，会丢弃配置的根目录；而相对路径遍历也可能解析到根目录之外。受保护的“非分页分支”会调用进行校验，但“分页分支”在打开路径前绕过了该验证。因此，任何未经验证的用户均可通过暴露于网络的 HTTP MCP 服务器读取服务器进程可访问的任意 UTF

CVSS 7.5 · High Updated Nov 06, 2026

Possible ATT&CK Techniques 3 AI

T1552 · Unsecured Credentials T1003 · OS Credential Dumping T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read

Source: CVE Program / CVE List V5

Vulnerability Description

Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.345, the MCPToolsRegistry.read_file implementation in codebase_rag/mcp/tools.py joins attacker-controlled file_path input to project_root without resolving and verifying containment when offset or limit selects the paginated branch. An absolute path causes pathlib to discard the configured root, while relative traversal can also resolve outside it. The protected non-paginated branch uses validate_project_path, but the paginated branch bypasses that validation before opening the path. An unauthenticated caller of a network-exposed HTTP MCP server can therefore read arbitrary UTF-8-readable files available to the server process, including credentials, environment data, private keys, source, and configuration; local callers through the stdio transport can reach the same vulnerable code path. This issue is fixed in version 0.0.345.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
vitali87	code-graph-rag	< 0.0.345	-

II. Public POCs for CVE-2026-77604

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-77604

请登录查看更多情报信息。

Other References for CVE-2026-77604 (3)

https://github.com/vitali87/code-graph-rag/releases/tag/v0.0.345 x_refsource_MISC
https://github.com/vitali87/code-graph-rag/security/advisories/GHSA-vvr2-h2jp-838m x_refsource_CONFIRM
https://github.com/vitali87/code-graph-rag/commit/6541e920a27961fa8f3ff49ef38c0e0bd09cd626 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-77604

IV. Related Vulnerabilities

Same product: code-graph-rag

CVE-2026-87008
Code Graph RAG structural tools follow out-of-root symlinks

Same vendor: vitali87

CVE-2026-87008
Code Graph RAG structural tools follow out-of-root symlinks

Same weakness: CWE-22