code-graph-rag vulnerabilities

CVEs whose affected-version data names the code-graph-rag package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

2 CVEsRSS

CVE-2026-87008High· 7.1PoC

2d ago

Code Graph RAG structural tools follow out-of-root symlinks

Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.589, AstGrepService in codebase_rag/tools/ast_grep_service.py enumerates files beneath p…

▾ Midnightvitali87 · code-graph-ragEPSS 0.26%via CVEORG

CVE-2026-77604High· 7.5

2d ago

Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read

Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.345, the MCPToolsRegistry.read_file implementation in codebase_rag/mcp/tools.py joins at…

▾ Twilightvitali87 · code-graph-ragEPSS 0.38%via CVEORG