Path Traversal Flaws Disclosed in Code Graph RAG Open-Source AI Tooling

Key facts

According to disclosure entries logged by VulDB, two separate path traversal flaws were registered against the vitali87 Code Graph RAG repository, highlighting distinct architectural points where file path handling failed to adequately restrict user- or agent-supplied input.

The first documented issue, assigned CVE-2026-87008, involves the software's path management mechanisms. Technical details published by VulDB identify the flaw within the path_utils.py file, specifically targeting the should_skip_path function. In retrieval-augmented generation architectures, path utility scripts typically determine which files, directories, and file extensions should be parsed, ignored, or indexed into a semantic graph. When path evaluation routines lack rigid boundary checks, relative path notations such as dot-dot-slash sequences can misdirect the routine. In this instance, VulDB reported that versions up to 0.0.588 contain the flaw, advising administrators and developers utilizing the component to deploy newer, corrected iterations.

The second vulnerability, recorded under CVE-2026-77604, affects an earlier baseline within a paginated branch of the software, spanning builds up to version 0.0.344. The entry attributes the weakness to the tools.py script, focusing specifically on the MCPToolsRegistry.read_file component. The registry name indicates an integration with the Model Context Protocol, an interface standard widely employed to connect large language models with external execution tools and data sources. The read_file handler within this registry was found vulnerable to directory traversal, creating conditions under which a file-reading request could reach beyond the designated root directory of the codebase being analyzed. As with the companion entry, VulDB recommended an immediate version upgrade for downstream users.

Why it matters

Path traversal vulnerabilities, categorized in industry standards under Common Weakness Enumeration entry CWE-22, represent a foundational class of software defects that carry elevated risks when embedded in artificial intelligence workflows. In conventional web applications, directory traversal typically permits an attacker to escape web root directories to view sensitive server files, such as environment configurations, system user registries, or application source code. When introduced into automated coding assistants and retrieval-augmented generation pipelines, the implications expand significantly.

In typical retrieval systems, an artificial intelligence agent or large language model relies on autonomous tools to explore directories, read source files, and assemble contextual maps. If a tool like read_file lacks rigorous sanitization, an adversary can exploit this weakness directly through manipulated inputs or indirectly through prompt injection attacks hidden inside repository files. If an autonomous model encounters instructions designed to trigger the MCP tool with an arbitrary file path, a vulnerable system could read sensitive configuration tokens, private cryptographic keys, or proprietary data hosted on the underlying infrastructure, feeding that information straight back into the model's contextual output stream. Because many software engineers run local language model assistants and code indexing tools with the full administrative privileges of their local development environments, vulnerabilities of this nature can grant arbitrary file reading capabilities across an engineer's workstation or continuous integration server.

Retrieval-augmented generation, commonly referred to as RAG, emerged as a dominant architecture for modern generative AI following the rapid enterprise adoption of large language models starting in late 2022. While base models possess broad knowledge learned during training, they lack real-time awareness of private codebases, proprietary internal libraries, and fast-moving technical repositories. RAG systems bridge this gap by querying external data sources, retrieving relevant snippets, and injecting those snippets into the prompt given to the language model.

For source code comprehension, standard vector-based RAG—which relies primarily on text chunking and similarity embeddings—often proves inadequate. Codebases rely on structural logic: functions call other functions, classes inherit from parent definitions, and modules import external dependencies. To address these structural relationships, developers created "Code Graph RAG" systems, which combine semantic vector search with knowledge graph databases. These systems parse code syntax trees, map callers and callees, and construct structured graphs representing an entire repository's architecture.

As developer-oriented AI ecosystems matured through 2024 and 2025, interoperability standards emerged to normalize how models interact with external environments. The Model Context Protocol, introduced by Anthropic in late 2024, quickly became a popular open standard across open-source and commercial developer tooling. The protocol provides a structured method for AI agents to query external tools—such as database clients, search engines, and local file system utilities—using standardized registries. However, integrating autonomous agents with local file operations introduced severe supply-chain and application security challenges. Standard file operations like read_file or path filters require careful sandboxing to prevent the model, or malicious text ingested by the model, from traversing outside the intended repository directory. When open-source utilities are released rapidly under experimental semantic version numbers (such as releases below 1.0.0), defensive input sanitization is frequently overlooked in favor of rapid feature iteration.

Reaction

The disclosures from VulDB did not incorporate public commentary or statements from the repository's author, Vitali87, nor did the database summaries document external incident reports or active exploitation in wild environments. In standard vulnerability management cycles, maintainers of open-source projects hosted on repositories like GitHub typically address such disclosures by issuing commits that canonicalize file paths, eliminate relative path syntax, and enforce boundary validations before files are opened or evaluated.

Security response teams and independent researchers who track AI tool security routinely emphasize that automated tooling operating on untrusted repositories must employ strict defense-in-depth principles. Industry guidance from application security bodies recommends that software registries implementing tool-calling protocols sandbox all file system interactions within isolated container boundaries or explicit path whitelists. Downstream software developers utilizing the vitali87 Code Graph RAG utility within automated indexing workflows or internal developer platforms are expected to evaluate their internal deployment pipelines and confirm that installed packages exceed versions 0.0.344 and 0.0.588 according to the respective advisory parameters.

What we don't know yet

Several substantive details remain unaddressed in the primary vulnerability reports cataloged by VulDB. The initial records do not specify whether the security gaps were uncovered during internal code auditing, reported by an external security researcher through a coordinated vulnerability disclosure process, or identified following an automated static analysis scan. Furthermore, the summaries do not indicate whether the vulnerabilities have received official Common Vulnerability Scoring System (CVSS) base severity ratings, which determine standardized impact metrics including attack vector, complexity, and privileges required.

The disclosure notices also do not detail whether any proof-of-concept exploit scripts have been publicly distributed or whether the maintainer has published specific formal patch versions with corresponding commit hashes beyond the recommendation to upgrade beyond the specified affected versions. It remains unconfirmed whether active exploitation has been detected against systems utilizing the package, or whether the software is embedded as a dependency in wider, commercial developer tools.

What to watch

Organizations and individual developers integrating code-graph RAG tooling should monitor the upstream package distribution channels, such as the Python Package Index (PyPI) or the project's source repository, for updated release tags that formally supersede version 0.0.588. Security analysts will look to the National Vulnerability Database (NVD), maintained by the U.S. National Institute of Standards and Technology, for the assignment of official CVSS vector strings and standardized severity tiers.

Additionally, observers should track technical discussions regarding Model Context Protocol security implementations, particularly regarding how registry tools handle path normalization when executing file read routines on behalf of language models. As open-source AI tooling proliferates across enterprise engineering environments, the adoption of mandatory sandboxing frameworks and automated testing against directory traversal attacks in AI-driven tools will serve as a key benchmark for software supply chain maturity.

Reporting for this article is based on vulnerability disclosure records published by VulDB.