CVE-2026-87008— Code Graph RAG structural tools follow out-of-root symlinks

Quick assessment

Affected

vitali87 code-graph-rag

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Code Graph RAG 是一个由人工智能驱动的知识图谱与检索系统，用于查询、理解和编辑多语言代码库。在 0.0.589 版本之前，中的会枚举下的文件，并依赖中的函数对其进行分类。然而，该包含性检查是基于未解析的 lexical 路径（字面路径）执行的。因此，若在被分析的项目仓库中植入一个符号链接（symbolic link），该链接可指向配置根目录之外的文件，同时仍被视为在扫描范围内。工具会跟随该符号链接，并在未经过任何审批流程的情况下泄露可读内容；而工具在模式下也会跟随该链接，直接覆盖可写内

CVSS 7.1 · High Updated Nov 06, 2026

Possible ATT&CK Techniques 3 AI

T1003 · OS Credential Dumping T1565 · Data Manipulation T1083 · File and Directory Discovery

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Code Graph RAG structural tools follow out-of-root symlinks

Source: CVE Program / CVE List V5

Vulnerability Description

Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.589, AstGrepService in codebase_rag/tools/ast_grep_service.py enumerates files beneath project_root and relies on should_skip_path in codebase_rag/utils/path_utils.py to classify them, but the containment check operates on unresolved lexical paths. A symbolic link planted inside an analyzed repository can therefore reference a file outside the configured root while still appearing in scope. The structural_search tool follows the link and discloses readable content without an approval gate, while structural_replace with dry_run=False follows it and overwrites writable content; the MCP path invokes structural replacement without the agent-loop approval control. An attacker who causes a victim to analyze a repository containing such a link can read credentials, keys, environment files, or sibling source and can modify files accessible to the code-graph-rag process. This issue is fixed in version 0.0.589.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
vitali87	code-graph-rag	< 0.0.589	-

II. Public POCs for CVE-2026-87008

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-87008

请登录查看更多情报信息。

Other References for CVE-2026-87008 (3)

https://github.com/vitali87/code-graph-rag/releases/tag/v0.0.589 x_refsource_MISC
https://github.com/vitali87/code-graph-rag/security/advisories/GHSA-85gg-2gfq-q95m x_refsource_CONFIRM
https://github.com/vitali87/code-graph-rag/commit/2648c95aa550ce2d9361a8e75ed669d5f4b451b8 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-87008

IV. Related Vulnerabilities

Same product: code-graph-rag

CVE-2026-77604
Code Graph RAG: MCP paginated read_file path traversal / arb

Same vendor: vitali87

CVE-2026-77604
Code Graph RAG: MCP paginated read_file path traversal / arb

Same weakness: CWE-22