naranor agent-coderag vulnerabilities

Latest naranor agent-coderag CVEs

Newest publication first

1. CVE-2026-57586 CodeRAG: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution

   Published 2026-09-15

   High·CVSS 8.6 EPSS 0.21%

   CodeRAG is a lightweight semantic code search and distillation utility for AI coding agents. Prior to 1.3.1, the default agent-coderag sync flow in code_rag/entry/cli.py calls sync_dependencies for an indexed path, and code_rag/core/manager.py treats build.gradle or build.gradle....

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.