The code-graph-rag tool's structural_search and structural_replace features have a vulnerability where symbolic links in a source-code repository can cause these tools to read or overwrite files outside the intended project root. This occurs because the path containment checks are performed lexically without resolving symlinks, allowing traversal outside the root directory. The issue affects versions prior to 0.0.587 and has been fixed in version 0.0.587. The vulnerability has a CVSS score of 7.1, indicating high severity, and can lead to unauthorized disclosure and modification of files.