code-graph-rag vulnerabilities

2 known vulnerabilities in code-graph-rag from Vitali87. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  code-graph-rag: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-87008Nov 5, 2026Vitali87

  Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.589, AstGrepService in codebase_rag/tools/ast_grep_service.py enumerates files beneath project_root and relies

• 7.5 High severity

  code-graph-rag: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-77604Nov 5, 2026Vitali87

  Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.345, the MCPToolsRegistry.read_file implementation in codebase_rag/mcp/tools.py joins attacker-controlled file_