code-graph-rag Patched a CVSS 7.1 Symlink Escape That Let Any Analyzed Repo Overwrite Files Outside the Project Root

GitHub·high signalXBlueskyLinkedInCopy link

Advisory GHSA-85gg-2gfq-q95m, patched in v0.0.589 released 2026-08-10 00:20 UTC, covers AstGrepService — the backend for the `structural_search` and `structural_replace` tools exposed both as MCP tools and as agent tools. Containment was checked lexically on the unresolved path with no `Path.is_symlink()` or `.resolve()` call, so a symlink planted in an analyzed repository let `structural_search` read arbitrary files and `structural_replace` with `dry_run=False` overwrite them. Everything at or below 0.0.588 is affected; this is the second path-handling advisory on the project after GHSA-vvr2-h2jp-838m.