CVE-2026-87008 with a CVSS score of 7.1 is a symbolic link path containment flaw in the structural_search and structural_replace tools of code-graph-rag, backed by AstGrepService and exposed through MCP and agentic AI interfaces. Affected versions are code-graph-rag (pip) versions <= 0.0.586. The flaw occurs because the tools perform lexical path-containment checks on unresolved paths while walking the project root, so a symbolic link placed inside the analyzed repository can point to files outside that root. A remote or local attacker who can influence repository contents, or an operator who analyzes an unaudited repository, can cause the tool to read arbitrary files readable by the process and, when structural_replace is invoked with dry_run=False, overwrite arbitrary writable files. The MCP path can bypass approval controls, while structural_search has no approval gate. Business impact includes disclosure of credentials, environment files, keys, or source code, plus unauthorized modification of sensitive files, potentially leading to data loss, integrity compromise, lateral movement, and operational disruption.
We recommend you to update code-graph-rag to version 0.0.587.[/subscribe_to_unlock_form]
CVE-2026-87008 with a CVSS score of 7.1 is a symbolic link path containment flaw in the structural_search and structural_replace tools of code-graph-rag, backed by AstGrepService and exposed through MCP and agentic AI interfaces. Affected versions are code-graph-rag (pip) versions <= 0.0.586. The flaw occurs because the tools perform lexical path-containment checks on unresolved paths while walking the project root, so a symbolic link placed inside the analyzed repository can point to files outside that root. A remote or local attacker who can influence repository contents, or an operator who analyzes an unaudited repository, can cause the tool to read arbitrary files readable by the process and, when structural_replace is invoked with dry_run=False, overwrite arbitrary writable files. The MCP path can bypass approval controls, while structural_search has no approval gate. Business impact includes disclosure of credentials, environment files, keys, or source code, plus unauthorized modification of sensitive files, potentially leading to data loss, integrity compromise, lateral movement, and operational disruption.
We recommend you to update code-graph-rag to version 0.0.587.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]