code-graph-rag structural tools follow symlinks outside project root
AI code analysis tool can peek at and overwrite outside files.
Summary
The structural search and replace tools in code-graph-rag can read and overwrite files outside the configured project root by following a link in an analyzed repository. Versions 0.0.588 and older are affected.
Affected when
- An analyzed repository contains a link pointing outside the project root
- The structural_search or structural_replace tool is used
What to do
Update to version 0.0.589.
Products and platforms
CVE IDs
Sources
- Write-up: github.com (opens in a new tab)
Times
First published
First seen