Code Graph RAG structural tools follow out-of-root symlinks
Affects code-graph-rag 0.0.588 and earlier when the structural_search or structural_replace tools run on a repository that contains an out-of-root symbolic link. Fixed in 0.0.589.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- Proof of concept public, per CISA
- Fix
- Fixed in 0.0.589
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. A symbolic link planted in a source-code repository that code-graph-rag analyzes, pointing to a file outside the configured project root. Affected code-graph-rag versions are 0.0.588 and earlier. The structural_search and structural_replace tools (backed by AstGrepService) are used on the analyzed repository.
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 28/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
- Exploitation: poc
- Automatable: no
- Technical impact: total
Summary
Code Graph RAG, an AI-powered tool for querying and editing multi-language codebases, has a flaw in its structural search and replace tools that follow symbolic links pointing outside the analyzed project. A local attacker who gets a victim to analyze a repository containing such a link, which requires the victim to take action, could read sensitive files such as credentials or environment files and modify files the tool can write to.
Read the original description
Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.589, AstGrepService in codebase_rag/tools/ast_grep_service.py enumerates files beneath project_root and relies on should_skip_path in codebase_rag/utils/path_utils.py to classify them, but the containment check operates on unresolved lexical paths. A symbolic link planted inside an analyzed repository can therefore reference a file outside the configured root while still appearing in scope. The structural_search tool follows the link and discloses readable content without an approval gate, while structural_replace with dry_run=False follows it and overwrites writable content; the MCP path invokes structural replacement without the agent-loop approval control. An attacker who causes a victim to analyze a repository containing such a link can read credentials, keys, environment files, or sibling source and can modify files accessible to the code-graph-rag process. This issue is fixed in version 0.0.589.
cve.now Index
- Exploitation15/40CISA rates a proof of concept as public
- Exposure5/25Specific setups only
- Reach?/20Unknown. No tracked technology or package matched
- Severity8.1/10CVSS 7.1, total technical impact per CISA
- No patch0/5No signal
What would change the score
- Would score about 63 if added to CISA KEV
- Would score about 58 if CISA's SSVC rates exploitation active
- Would score about 38 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
A symbolic link planted in a source-code repository that code-graph-rag analyzes, pointing to a file outside the configured project root. Affected code-graph-rag versions are 0.0.588 and earlier. The structural_search and structural_replace tools (backed by AstGrepService) are used on the analyzed repository.Upgrade to a fixed version: 0.0.589.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: poc · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- vitali87 code-graph-rag
fixed in 0.0.589
Evidence 4
- Advisory
- Exploit
- Repository
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-87008
Is CVE-2026-87008 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
The structural_search and structural_replace tools follow a symbolic link in an analyzed repository to a file outside the configured project root. That can expose files the cgr process can read, such as credentials, SSH keys, or .env files, and with dry_run=False it can overwrite files the process can write.Source: github.com, github.com
Which versions are affected by CVE-2026-87008?
code-graph-rag: before 0.0.589.Source: cve.now feed data
Am I affected, and how do I check?
code-graph-rag 0.0.588 and earlier are affected when the structural_search or structural_replace tools run on an analyzed repository. To check the installed version, look at the code-graph-rag package version; the fix is in 0.0.589.Source: github.com, github.com
How do I fix CVE-2026-87008?
Upgrade to code-graph-rag 0.0.589 or later. The advisory recommends this if repositories are analyzed that are not fully under your control.Source: github.com, github.com