Code-graph-rag patches symlink bug that let repos overwrite files

A planted symlink let code-graph-rag read or overwrite files outside a repo's root, per a GitHub security advisory patched August 10.

GitHub scored the flaw CVSS 7.1. Both vulnerable functions are exposed as MCP tools and agent tools, so an AI agent pointed at an untrusted repository inherited the exposure.

AstGrepService checked path containment on the raw, unresolved path. It never called Path.is_symlink() or .resolve(), so a symlink pointing outside the project directory passed the check.

structural_search could then read arbitrary files through the planted link. structural_replace, called with dry_run=False, could overwrite them.

The fix shipped in v0.0.589 at 00:20 UTC on August 10, per GHSA-85gg-2gfq-q95m. Every version at or before 0.0.588 is affected. GitHub's advisory record shows this is the project's second path-handling advisory.

What to do

Upgrade to v0.0.589 if you run code-graph-rag against repositories you don't fully control. That risk is sharper through an MCP client, where an agent might point the tool at an untrusted repo on its own.

The advisory doesn't say whether GitHub audited code-graph-rag's other file-handling tools for the same unresolved-path pattern. Treat this as one instance found, not a guarantee the rest are clean.