Download Latest Version
code-graph-rag-windows-amd64.exe (52.0 MB)
Get an email when there's a new version of Code-Graph-RAG
| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| multiple.intoto.jsonl | 2026-08-10 | 11.6 kB | |
| code-graph-rag-darwin-amd64.sigstore.json | 2026-08-10 | 10.7 kB | |
| code-graph-rag-darwin-arm64.sigstore.json | 2026-08-10 | 10.7 kB | |
| code-graph-rag-linux-amd64.sigstore.json | 2026-08-10 | 10.8 kB | |
| code-graph-rag-windows-amd64.exe.sigstore.json | 2026-08-10 | 10.7 kB | |
| code-graph-rag-darwin-amd64 | 2026-08-10 | 51.9 MB | |
| code-graph-rag-linux-amd64 | 2026-08-10 | 69.3 MB | |
| code-graph-rag-windows-amd64.exe | 2026-08-10 | 51.8 MB | |
| code-graph-rag-darwin-arm64 | 2026-08-10 | 50.7 MB | |
| README.md | 2026-08-09 | 1.7 kB | |
| v0.0.589 source code.tar.gz | 2026-08-09 | 12.1 MB | |
| v0.0.589 source code.zip | 2026-08-09 | 12.8 MB | |
| Totals: 12 Items | 248.7 MB | 0 | |
Highlights
- Security: Fixes a symlink-following arbitrary file read/write in the
structural_search/structural_replacetools. Upgrade is strongly recommended for anyone runningcgr(CLI, agent, or MCP) against untrusted repositories. - Release automation: NEWS.md and the README "Latest News" section now refresh automatically on each release.
- Binary CI hardening: Prebuilt binaries are now built on build-input pull requests and on a weekly schedule, so packaging regressions and upstream drift are caught before a release.
🔒 Security
Fixes a symlink-following path-containment escape (High, CVSS 7.1) in AstGrepService, which backs the structural_search and structural_replace tools (both MCP and agent surfaces) — advisory GHSA-85gg-2gfq-q95m (CWE-22, CWE-59). A symlink planted inside an analyzed repository, pointing outside the configured project root, was followed because containment was checked lexically on the unresolved path: structural_search could read arbitrary files and structural_replace (with dry_run=False) could overwrite them. Upgrade to 0.0.589 if you run cgr against repositories you do not fully control.
Affected: <= 0.0.588 · Patched: 0.0.589. Credit: Dostxodjayev Abdullox (@squeeze440).
What's Changed
- feat: auto-refresh NEWS.md and README latest news on every release by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1147
- ci: build binaries on build-input PRs and weekly schedule by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1148
Full Changelog: https://github.com/vitali87/code-graph-rag/compare/v0.0.586...v0.0.589
