{"id":"EM-20261109-2KQO","url":"https://cyber.eventmonitor.net/incident/EM-20261109-2KQO/code-graph-rag-vulnerability-cve-2026-87008/","type":"cve","title":"Code Graph RAG Vulnerability (CVE-2026-87008)","subtitle":"CVE-2026-87008","subject":"CVE-2026-87008","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-09T22:16:41.000Z","firstSignal":"2026-11-05T21:18:54.370Z","lastSignal":"2026-11-09T22:16:41.000Z","updated":"2026-11-09T23:10:58.551Z","revision":1,"life":[{"status":"Born","at":"2026-11-09T22:16:41.000Z","why":"second independent source: C26 GitHub Advisory Database"},{"status":"Developing","at":"2026-11-09T22:16:41.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-05T21:18:54.370Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-09T22:16:41.000Z","what":"Born: second source, C26 GitHub Advisory Database. Page EM-20261109-2KQO created."}],"stages":[{"name":"Disclosed","at":"2026-11-05T21:18:54.370Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-05T21:18:54.370Z","detail":"CVSS 7.1 · EPSS 0.3%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-05T21:18:54.370Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-87008 (CVSS 7.1)","text":"Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.589, AstGrepService in codebase_rag/tools/ast_grep_service.py enumerates files beneath project_root and relies on should_skip_path in codebase_rag/utils/path_utils.py to classify them, but the containment check operates on unresolved lexical paths. A symbolic link planted inside an analyzed repository can therefore reference a file outside the configured root while still appearing in scope. The structural_search tool follows the link and…","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87008"},{"at":"2026-11-09T22:16:41.000Z","source":"C26","sourceName":"GitHub Advisory Database","role":"Database","severity":3,"title":"GHSA-85gg-2gfq-q95m / CVE-2026-87008: Code Graph RAG structural tools follow out-of-root symlinks","text":"pip:code-graph-rag","url":"https://github.com/advisories/GHSA-85gg-2gfq-q95m"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-05T21:18:54.370","score":7.1,"severity":"HIGH","desc":"Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.589, AstGrepService in codebase_rag/tools/ast_grep_service.py enumerates files beneath project_root and relies on should_skip_path in…","product":"","seen":1793922090303},"kev":null,"epss":{"epss":0.00264,"pct":0.18371,"at":1794265858551},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}