Two path traversal flaws disclosed in code-graph-rag's MCP tools

GitHub Security Advisories published two high-severity advisories on November 9, 2026, for code-graph-rag, a pip package that provides codebase retrieval-augmented-generation (RAG) tools for AI coding assistants. The GHSA-85gg-2gfq-q95m advisory and a companion disclosure show that the package's structural_search, structural_replace and read_file MCP tools allow symlink and absolute-path traversal outside the project root on a server that is unauthenticated and exposed by default.

What the advisories disclose

• GHSA-85gg-2gfq-q95m (CVE-2026-87008): the structural_search and structural_replace MCP tools follow symlinks outside the project root, rated High with a CVSS score of 7.1, fixed in version 0.0.587
• GHSA-vvr2-h2jp-838m (CVE-2026-77604): the paginated read_file MCP tool allows absolute-path traversal, rated High with a CVSS score of 7.5, fixed in version 0.0.345
• Both advisories were published to the GitHub Advisory Database on November 9, 2026
• The affected server binds to 0.0.0.0:8080 by default with no authentication
• Both flaws let an unauthenticated remote attacker read or modify arbitrary files, including credentials and API keys, through the MCP server

What it means for people who build with AI

The disclosure is a reminder that an AI coding assistant's own tool server is part of its attack surface. Because the code-graph-rag server listens on 0.0.0.0:8080 without authentication by default, any team that ran it with that default configuration exposed every file reachable by the server, including credentials and API keys, to any unauthenticated remote attacker able to reach the port. Builders who wire MCP file tools into coding assistants need to treat those servers with the same scrutiny as any other network service that can read and write files.

Fixes and availability

The symlink traversal affecting structural_search and structural_replace is fixed in code-graph-rag version 0.0.587. The absolute-path traversal affecting read_file is fixed in version 0.0.345. Teams running code-graph-rag should upgrade to at least those versions and check whether the MCP server has been exposed beyond localhost without authentication.

Sources

• code-graph-rag symlink path traversal in structural_search/structural_replace (CVE-2026-87008) (GitHub Security Advisories, November 9, 2026, official)
• code-graph-rag absolute-path traversal in read_file MCP tool (CVE-2026-77604) (GitHub Security Advisories, November 9, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.