pypi code-graph-rag vulnerabilities

Latest pypi code-graph-rag CVEs

Newest publication first

1. CVE-2026-87008 Code Graph RAG structural tools follow out-of-root symlinks

   Published 2026-11-05

   High·CVSS 7.1 EPSS 0.26%

   Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.589, AstGrepService in codebase_rag/tools/ast_grep_service.py enumerates files beneath project_root and relies on should_skip_path...

2. CVE-2026-77604 Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read

   Published 2026-11-05

   High·CVSS 7.5 EPSS 0.39%

   Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.345, the MCPToolsRegistry.read_file implementation in codebase_rag/mcp/tools.py joins attacker-controlled file_path input to projec...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.