CVE-2026-87008

Code Graph RAG structural tools follow links outside the repository

vitali87 · Code Graph RAG AstGrepService

First documented disclosure · Review checkpoint

Summary

A repository symlink can direct structural search or replacement to an outside file.

Severity and exploitation evidence

High · 7.1/10 · CVSS 3.1. Severity source.

Exploitation not established: The advisory records a controlled reproduction. No malicious use or affected customer is established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Containment is checked against a lexical path without resolving the symlink. The actual read or write follows its target.

Conditions required

The victim analyzes a repository containing a hostile symlink and the process can read or write the target. MCP replacement bypasses the approval flag enforced by the separate agent loop.

Potential impact

Structural search can disclose outside content; non-dry-run replacement can overwrite it.

Affected versions and configurations

Before 0.0.589; the researcher tested 0.0.550 after the earlier paginated-read fix.

Fix and mitigation status

0.0.589.

Practical next steps

Upgrade and isolate analysis of untrusted repositories from credentials and unrelated writable files.

Operating lesson

Resolve the actual filesystem target before enforcing repository boundaries on every tool path.

Evidence and limits

The advisory and fixed release were public August 10; the patch commit is dated August 9 but no associated public pull request was returned. November 5 is CVE publication.

Sources