{"id":"CVE-2026-87008","kind":"vulnerability","aliases":["CVE-2026-87008"],"related":[],"title":"Code Graph RAG: symlinks let analyzed repositories read and overwrite outside files","description":"Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.589, AstGrepService in codebase_rag/tools/ast_grep_service.py enumerates files beneath project_root and relies on should_skip_path in codebase_rag/utils/path_utils.py to classify them, but the containment check operates on unresolved lexical paths. A symbolic link planted inside an analyzed repository can therefore reference a file outside the configured root while still appearing in scope. The structural_search tool follows the link and discloses readable content without an approval gate, while structural_replace with dry_run=False follows it and overwrites writable content; the MCP path invokes structural replacement without the agent-loop approval control. An attacker who causes a victim to analyze a repository containing such a link can read credentials, keys, environment files, or sibling source and can modify files accessible to the code-graph-rag process. This issue is fixed in version 0.0.589.","summary":"Code Graph RAG, an AI tool that builds a knowledge graph of code, follows symbolic links inside an analyzed repository to files outside the configured project root. An attacker who gets a victim to analyze a repository containing such a link can read credentials and environment files, and can overwrite writable files through the structural replace tool.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","code-graph-rag","mcp","python"],"not_affected_if":["trusted-repositories-only","version-0.0.589-or-later"],"how_to_check":"- Check the installed Code Graph RAG version is below `0.0.589`.\n- Search analyzed repositories for symbolic links pointing outside the project root, for example with `find . -type l`.","fix":"- Code Graph RAG: upgrade to `0.0.589`.","status":"open","published_at":"2026-11-05T21:18:54+00:00","first_seen_at":"2026-11-05T21:40:45+00:00","triaged_at":"2026-11-05T21:41:13+00:00","updated_at":"2026-11-05T21:41:13+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-05T21:41:13Z","model":"claude-haiku-5-5","output":{"fix":"- Code Graph RAG: upgrade to `0.0.589`.","reach":"local","title":"Code Graph RAG: symlinks let analyzed repositories read and overwrite outside files","impact":"high","summary":"Code Graph RAG, an AI tool that builds a knowledge graph of code, follows symbolic links inside an analyzed repository to files outside the configured project root. An attacker who gets a victim to analyze a repository containing such a link can read credentials and environment files, and can overwrite writable files through the structural replace tool.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["code-graph-rag","mcp","python","ai-agents"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Credentials and environment files readable; files overwritten by the tool","analyst_note":"Confirm the fixed version in the vendor advisory and release notes linked from the NVD entry; the sources here give only the description.","how_to_check":"- Check the installed Code Graph RAG version is below `0.0.589`.\n- Search analyzed repositories for symbolic links pointing outside the project root, for example with `find . -type l`.","plain_action":"","needs_analyst":true,"not_affected_if":["version-0.0.589-or-later","trusted-repositories-only"],"who_is_affected":"Teams that run Code Graph RAG (including its MCP server) against repositories they did not fully author, since a planted symlink is the trigger. Exposure depends on whether the process can read secrets or write files outside the project root. Setups that only analyze trusted repositories with no untrusted symlinks are lower risk.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000752,"input_tokens":4501,"output_tokens":604,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-87008':15A,18A '0.0.589':112C,247C 'access':233C 'agent':21B,202C 'agent-loop':201C 'ai':20B,23B,35B,94C 'ai-ag':19B 'ai-pow':93C 'ai-tool':22B 'analyz':6A,49B,65B,149C,213C 'appear':162C 'approv':178C,204C 'astgrepservic':113C 'attack':59B,207C 'beneath':119C 'build':38B 'caus':209C 'check':137C 'classifi':132C 'code':1A,26B,31B,43B,88C,237C 'code-graph-rag':25B,236C 'codebas':109C,115C,129C 'configur':55B,158C 'contain':68B,136C,216C 'content':175C,192C 'control':205C 'credenti':74B,222C 'cve':13A,16A 'disclos':173C 'dri':184C 'edit':105C 'enumer':117C 'environ':76B,224C 'fals':186C 'file':12A,52B,77B,82B,118C,155C,225C,232C 'fix':244C 'follow':44B,169C,187C 'gate':179C 'get':61B 'graph':2A,27B,32B,41B,89C,97C,238C 'insid':47B,147C 'invok':196C 'issu':242C 'key':223C 'knowledg':40B,96C 'languag':108C 'let':5A 'lexic':141C 'link':46B,71B,145C,171C,219C 'loop':203C 'mcp':29B,194C 'modifi':231C 'multi':107C 'multi-languag':106C 'oper':138C 'outsid':11A,53B,156C 'overwrit':10A,80B,190C 'path':127C,142C,195C 'plant':146C 'power':95C 'prior':110C 'process':240C 'project':56B,120C 'python':30B 'queri':102C 'rag':3A,28B,33B,90C,239C 'rag/tools/ast_grep_service.py':116C 'rag/utils/path_utils.py':130C 'read':8A,73B,221C 'readabl':174C 'refer':153C 'reli':123C 'replac':86B,182C,198C 'repositori':7A,50B,67B,150C,215C 'retriev':99C 'root':57B,121C,159C 'run':185C 'scope':164C 'search':167C 'sibl':227C 'skip':126C 'sourc':228C 'still':161C 'structur':85B,166C,181C,197C 'symbol':45B,144C 'symlink':4A 'system':100C 'therefor':152C 'tool':24B,36B,87B,168C 'understand':103C 'unresolv':140C 'version':246C 'victim':63B,211C 'without':176C,199C 'writabl':81B,191C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Code Graph RAG (including its MCP server) against repositories they did not fully author, since a planted symlink is the trigger. Exposure depends on whether the process can read secrets or write files outside the project root. Setups that only analyze trusted repositories with no untrusted symlinks are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aiagents","aitooling","codegraphrag","high","mcp","python"],"campaign_type":null,"first_public_at":"2026-08-10T00:10:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87008","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87008","severity":null,"published_at":"2026-11-05T21:18:54+00:00","modified_at":"2026-11-05T21:18:54+00:00","first_seen_at":"2026-11-05T21:40:45+00:00","fetched_at":"2026-11-05T21:40:45+00:00","note":null}],"documents":[{"id":80397,"url":"https://github.com/vitali87/code-graph-rag/commit/2648c95aa550ce2d9361a8e75ed669d5f4b451b8","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":80398,"url":"https://github.com/vitali87/code-graph-rag/releases/tag/v0.0.589","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":80399,"url":"https://github.com/vitali87/code-graph-rag/security/advisories/GHSA-85gg-2gfq-q95m","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-10T00:10:54+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}