Code Graph RAG path traversal and symlink vulnerabilities

Two separate vulnerabilities in Code Graph RAG allow attackers to read and write arbitrary files outside the configured project root: a path traversal in the paginated read_file MCP tool, and unresolved symlink following in structural_search and structural_replace tools.

Disclosed 9 November 2026 · Record updated 10 November 2026

Impact

Unauthenticated attackers can read arbitrary files via path traversal in the paginated read_file MCP tool when HTTP transport is configured; attackers with repository access can read and overwrite arbitrary files via symlink following in structural_search and structural_replace tools.

Our coverage

A robot's mechanical hand reaches beyond an invisible boundary, fingers grasping through a locked door frame toward forbidden files in shadow.

Vulnerabilities

Two file-escape flaws found in Code Graph RAG agent tools

Advisories published on 9 November 2026 describe a path traversal in the read_file tool and symlink following in structural search and replace.

10 Nov 2026

Sources

github.comhttps://github.com/advisories/GHSA-vvr2-h2jp-838m
github.comhttps://github.com/advisories/GHSA-85gg-2gfq-q95m