Paginated file-read tool lets attackers escape the project folder and read any server file
A file-read tool in an AI code assistant can be tricked into reading any file on the server, not just files inside the project folder. GitHub's advisory database reports that the flaw requires no authentication when the HTTP server is exposed to the network.
- Affected
- code-graph-rag < 0.0.345
- Fixed
- code-graph-rag 0.0.345
The flaw is in the paginated branch of the MCP read_file tool, which runs when a caller supplies offset or limit. It joins the project root with the caller-supplied file_path, but pathlib discards the root when the path is absolute. The non-paginated branch is guarded by validate_project_path; the paginated branch skips that check, so /etc/passwd opens directly.
The default HTTP MCP endpoint listens on 0.0.0.0:8080 without authentication, so anyone on the network can read any UTF-8 file the server process can reach: password files, credentials, keys, secrets and source outside the project. The same path is reachable locally through stdio.
Version 0.0.345 of code-graph-rag fixes it; every version below 0.0.345 is affected. Administrators should update to 0.0.345, which checks that the resolved path stays inside the project root.
Sources & technical scope 2 sources
GitHub Advisory Database — original source ↗
GitHub_M CNA / CVE Program — original source ↗
Affected: code-graph-rag < 0.0.345
Fixed: code-graph-rag 0.0.345
Exploitation: Unauthenticated remote exploitation is possible via the default HTTP transport; the same code path is reachable locally via stdio. Supplied evidence includes no KEV catalog entry.
Scope & limitations: Per-version testing and the versions individually tested by researchers are not specified; the proof of concept mocked the native Memgraph client and built the object without __init__. Authentication status beyond the default HTTP configuration is not established by the supplied evidence.
External findings belong to the credited researchers.