CVE-2026-77604

Code Graph RAG paginated file reads escape the project directory

vitali87 · Code Graph RAG MCP read_file

First documented disclosure · Review checkpoint

Summary

The paginated tool path can read files outside the configured code repository.

Severity and exploitation evidence

High · 7.5/10 · CVSS 3.1. Severity source.

Exploitation not established: The researcher demonstrated a controlled file read. The reviewed sources do not report malicious use.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

When offset or limit is supplied, the handler joins an untrusted path without resolving and checking containment; the non-paginated validation is bypassed.

Conditions required

The caller can invoke the tool. The reported HTTP configuration exposes it without authentication; stdio callers reach the same code with local access.

Potential impact

Files readable as UTF-8 by the service account may be disclosed, including configuration and credentials.

Affected versions and configurations

CNA: before 0.0.345. The original advisory and release describe versions through 0.0.343.

Fix and mitigation status

0.0.345 addresses this read_file issue.

Practical next steps

Upgrade to a supported release containing the fix and restrict HTTP MCP access.

Operating lesson

Pagination must preserve the authorization and path checks applied to ordinary reads.

Evidence and limits

The July 14 release and advisory precede November 5 CVE publication. This issue is separate from the later structural-tool symlink flaw fixed in 0.0.589.

Sources