Threats tagged 'ghsa-vvr2-h2jp-838m'

The code-graph-rag package contains a path traversal vulnerability (CVE-2026-77604) in the read_file MCP tool's paginated branch. When offset or limit parameters are supplied, the code constructs a file path without validating that it remains within the project root, allowing absolute paths to bypass restrictions. This enables an attacker to read arbitrary UTF-8-readable files on the server, such as /etc/hosts. The non-paginated branch is protected by a path validation decorator, but this is not applied in the paginated branch. The vulnerability is unauthenticated and network-accessible when the HTTP transport is enabled. A fix is available in version 0.0.345.