Code-Graph-RAG Files

🔒 Security

This release closes an EXECUTE_SHELL allowlist bypass: several allowlisted commands are generic "run anything" primitives, so an attacker-controlled repository could reach unconfined code execution through a command the allowlist treated as benign.

GHSA-wvxg-744g-6pcg - allowlisted launchers reach unconfined RCE (High, CVSS 7.3, CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, CWE-78 / CWE-863). xargs is allowlisted, but nothing stopped it launching an interpreter that is not (python3, perl, ruby, node, ...); the single blacklist rule meant to catch this only fired when a Python one-liner imported os by name, so subprocess, pty or ctypes slipped past. Execution was neither sandboxed to the project root nor limited to the allowlisted set, gated only by the approval step - one click in default mode, nothing under --yolo. The same review found six further spellings of the same class, all fixed here: sed writing outside the project root via -e 'w FILE', -i and -l flag clusters, sed -f running an unvetted script file, git --exec-path resolving a planted git-<name> binary, and git --git-dir / -C pointing at a repository whose alias.* config runs an arbitrary shell command. The guards now live on the launcher recursion, so nesting one allowlisted launcher inside another cannot weaken the decision. Credit: @SyedAnas01.

Affected: <= 0.0.844 · Patched: 0.0.845. Upgrade to 0.0.845 if you run cgr against repositories you do not fully control.

Highlights

• Security: Fixes an EXECUTE_SHELL allowlist bypass where allowlisted launchers (xargs, sed, git) could run unvetted programs or write outside the project root - advisory GHSA-wvxg-744g-6pcg. Upgrade is strongly recommended for anyone running cgr (CLI, agent, or MCP) against untrusted repositories.
• Test Reliability: Guard grammar-dependent tests on the production loader to prevent failures.
• Index Consistency: Ensure incremental deletes match clean index states.
• Patch Reporting: Distinguish between unverifiable and verified patches in reports.
• Windows Teardown: Clear the read-only bit when removing a temp repo for successful Windows teardown.
• TypeScript Grading: Grade TypeScript inheritance against the tsc oracle for improved accuracy.
• Exclude Set Handling: Record the exclusion set to ensure --exclude flags are correctly applied across runs.
• MCP Indexing: Honour .cgrignore and .gitignore in MCP index and update processes, matching the CLI.

What's Changed

• fix: guard grammar-dependent tests on the production loader, not on importability (#1591) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1593
• test: pin that an incremental delete matches a clean index by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1594
• fix: report an unverifiable patch distinctly from a verified one by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1595
• fix: clear the read-only bit when removing a temp repo so Windows teardown succeeds (#1586) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1597
• feat: grade TypeScript inheritance against the tsc oracle by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1519
• fix: re-parse a directory's modules when its package-ness flips and prune the container node the flip left behind by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1572
• fix: preserve rejected highlights in release news by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1600
• docs: explain how indexing treats a git submodule by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1596
• chore: exclude constants from coverage, matching the sonar config by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1611
• fix: parse release highlights whose colon sits inside the bold theme by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1614
• fix: report highlight parse failures instead of exiting 0 silently by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1618
• fix: tolerate a path that vanishes mid-teardown (#1586 follow-up) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1598
• chore(deps): bump transformers from 5.5.0 to 5.10.1 in the uv group across 1 directory by @dependabot[bot] in https://github.com/vitali87/code-graph-rag/pull/1607
• docs: backfill the v0.0.820 feature news the parse outage skipped by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1623
• fix: record the exclusion set so a changed --exclude re-runs instead of skipping by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1621
• fix: MCP index and update honour .cgrignore and .gitignore like the CLI (#1616) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1624
• fix: reset skipped_because_in_sync per run so a reused updater does not report a stale skip (#1620) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1626
• fix: accept a missing space after the colon in both news extractors by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1627
• feat: verify a PR is actually gated before merging (#1582) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1625
• fix(fingerprint): treat capture selection as parser identity by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1633
• fix: skip vendored minified bundles and make the ~ ignore entry live (#1636) by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1638
• fix: commit the hash cache after the graph flush so a crash cannot hide a deletion by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1635
• fix: let a run finish when the mis-stamped cache cannot be removed either by @vitali87 in https://github.com/vitali87/code-graph-rag/pull/1644

Full Changelog: https://github.com/vitali87/code-graph-rag/compare/v0.0.820...v0.0.845