File Enumeration Issue in Code Graph RAG by Vitali87
CVE-2026-87008

7.1HIGH

Key Information:

Vendor

Vitali87

Status
Code-graph-rag
Vendor
CVE Published:
5 November 2026

What is CVE-2026-87008?

The Code Graph RAG, an AI-driven knowledge graph for querying multi-language codebases, contains a file enumeration issue prior to version 0.0.589. The problem arises from the AstGrepService, which mistakenly enumerates files beneath the project root due to a containment check flaw. This vulnerability allows an attacker to exploit symbolic links inside analyzed repositories, exposing sensitive information, such as credentials and environment files, or modifying accessible files. The issue has been resolved in version 0.0.589, ensuring better security against unauthorized data access.

Affected Version(s)

code-graph-rag < 0.0.589

References

https://github.com/vitali87/code-graph-rag/security/advis...
x_refsource_CONFIRM
https://github.com/vitali87/code-graph-rag/commit/2648c95...
x_refsource_MISC
https://github.com/vitali87/code-graph-rag/releases/tag/v...
x_refsource_MISC

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.