{"id":7202,"date":"2026-11-11T15:24:58","date_gmt":"2026-11-11T15:24:58","guid":{"rendered":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-87008-code-graph-rag-symlink-vulnerability"},"modified":"2026-11-11T15:24:58","modified_gmt":"2026-11-11T15:24:58","slug":"cve-2026-87008-code-graph-rag-symlink-vulnerability","status":"publish","type":"post","link":"https:\/\/i10x.ai\/news\/cve-2026-87008-code-graph-rag-symlink-vulnerability","title":{"rendered":"CVE-2026-87008: Symlink Vulnerability in Code Graph RAG Allows Arbitrary File Read and Write Outside Project Root"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Overview<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A high-severity security vulnerability tracked as CVE-2026-87008 has been disclosed in Code Graph RAG, an AI-powered knowledge graph and retrieval system for querying and editing multi-language codebases. The flaw allows attackers to bypass path containment checks and access files outside the configured project root through symbolic link manipulation.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Vulnerability Details<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The vulnerability exists in the AstGrepService component within `codebase_rag\/tools\/ast_grep_service.py`. According to the GitHub security advisory GHSA-85gg-2gfq-q95m, the service enumerates files beneath the project root and relies on `should_skip_path` in `codebase_rag\/utils\/path_utils.py` to classify them. However, the containment check operates on unresolved lexical paths rather than resolved filesystem paths.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A symbolic link planted inside an analyzed repository can reference a file outside the configured root while still appearing to be in scope. The `structural_search` tool follows the link and discloses readable content without an approval gate, while `structural_replace` with `dry_run=False` follows it and overwrites writable content.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Technical Root Cause<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The advisory explains that the path-containment check in `should_skip_path` and `_classify_file` is performed lexically on the unresolved path. The code never checks `Path.is_symlink()` or calls `.resolve()`, unlike the project&#8217;s own `validate_project_path` decorator used elsewhere in the codebase.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Specifically:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>`_iter_source_files` walks `self.project_root` with `os.walk()` and treats every non-directory entry, including symlinks, as an in-scope file<\/li><li>`_classify_file` performs containment checks using `should_skip_path()` followed by `abs_path.relative_to(self.project_root)` without resolving the path<\/li><li>`should_skip_path` computes `rel_path = file_path.relative_to(repo_path)` without calling `.resolve()` or checking for symlinks<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The read sink occurs in the `search` method at line 143-144, where `self._read(abs_path)` calls `path.read_text()`, which Python follows through the symlink. The write sink occurs in the `replace` method at line 208, where `abs_path.write_text(new_source, &#8230;)` overwrites the real target file when `dry_run=False`.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Affected Versions and Systems<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">According to the NVD entry and GitHub advisory, the vulnerability affects Code Graph RAG version 0.0.588 and earlier. The issue impacts both the MCP (Model Context Protocol) tools and agentic AI tools backed by AstGrepService.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Exploitation and Impact<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The advisory states that a remote or local attacker who can get a symbolic link included in a source-code repository that code-graph-rag analyzes can exploit this vulnerability. The `structural_search` tool carries no `requires_approval` flag, meaning in AI-orchestrator mode the model can call it autonomously with no human confirmation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">While `structural_replace` is marked `requires_approval=True`, this flag is only enforced by pydantic-ai&#8217;s agent loop. The MCP server path bypasses it entirely, as `MCPToolsRegistry.structural_replace` calls `self._structural_editor_tool.function(&#8230;)` directly with no approval concept.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The advisory notes this is &#8220;a distinct, still-open issue&#8221; separate from a prior advisory (GHSA-vvr2-h2jp-838m) concerning paginated read_file path traversal, and represents &#8220;a strictly worse impact (write, not just read).&#8221;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Proof of Concept<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The GitHub advisory includes a proof of concept demonstrating the vulnerability. The PoC creates a symbolic link inside a safe project root pointing to a file outside that root, then uses AstGrepService to search for and replace content, successfully reading and modifying the external file.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Patch and Mitigation<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Version 0.0.589 patches the vulnerability. The fix, committed as 2648c95aa550ce2d9361a8e75ed669d5f4b451b8, adds symlink resolution to the `should_skip_path` function before performing containment checks.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The patch adds the following logic to `codebase_rag\/utils\/path_utils.py`:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&#8220;`python<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">try:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">    path.resolve().relative_to(repo_path.resolve())<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">except ValueError:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">    return True<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&#8220;`<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This mirrors the approach used in `validate_project_path` and `absolute_path_within_project_root` elsewhere in the codebase. The fix includes 89 lines of new test coverage in `codebase_rag\/tests\/test_symlink_containment.py` to verify that symlinks resolving outside the root are rejected while those inside are kept.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The release notes for v0.0.589, published on August 10, 2026, state: &#8220;Upgrade is strongly recommended for anyone running cgr (CLI, agent, or MCP) against untrusted repositories.&#8221;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">CVSS Score<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The vulnerability has been assigned a CVSS score of 7.1, classified as HIGH severity according to the NVD entry.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Recommendations<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Users of Code Graph RAG should immediately upgrade to version 0.0.589 or later, particularly if analyzing repositories from untrusted sources. Organizations running the CLI, agent, or MCP server against repositories they do not fully control face the highest risk and should prioritize this update.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-87008\" target=\"_blank\" rel=\"noreferrer noopener\">NVD &#8211; CVE-2026-87008<\/a><\/li><li><a href=\"https:\/\/github.com\/vitali87\/code-graph-rag\/security\/advisories\/GHSA-85gg-2gfq-q95m\" target=\"_blank\" rel=\"noreferrer noopener\">GitHub Security Advisory GHSA-85gg-2gfq-q95m<\/a><\/li><li><a href=\"https:\/\/github.com\/vitali87\/code-graph-rag\/commit\/2648c95aa550ce2d9361a8e75ed669d5f4b451b8\" target=\"_blank\" rel=\"noreferrer noopener\">Fix commit 2648c95<\/a><\/li><li><a href=\"https:\/\/github.com\/vitali87\/code-graph-rag\/releases\/tag\/v0.0.589\" target=\"_blank\" rel=\"noreferrer noopener\">Release v0.0.589<\/a><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>A high-severity symlink-following vulnerability in Code Graph RAG versions up to 0.0.588 allows attackers to read and overwrite arbitrary files outside the configured project root through the structural_search and structural_replace tools.<\/p>\n","protected":false},"author":2,"featured_media":7201,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"paper_title":"","paper_url":"","pdf_url":"","doi":"","arxiv_id":"","authors":"","institutions":"","paper_date":"","venue":"","peer_reviewed":false,"code_url":"","data_url":"","funding_coi":"","figure_license":"","paper_license":"","replication":"","study_models":"","study_sample":"","footnotes":"","_yoast_wpseo_primary_category":"65","_nx_sec_severity":"high","_nx_sec_affected":"Code Graph RAG versions up to and including 0.0.588","_nx_sec_status":"patch-available","_nx_sec_kicker":"URGENT: Symlink Flaw Enables File System Escape in AI Code Analysis Tool"},"categories":[14,65,12,28],"tags":[],"companies":[],"products":[],"class_list":["post-7202","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-agents","category-ai-security","category-policy-safety","category-security-defense"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>CVE-2026-87008: Code Graph RAG Symlink Vulnerability<\/title>\n<meta name=\"description\" content=\"CVE-2026-87008 exposes Code Graph RAG to symlink attacks allowing arbitrary file read\/write outside project root via AstGrepService tools.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/i10xnews.kinsta.cloud\/cve-2026-87008-code-graph-rag-symlink-vulnerability\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CVE-2026-87008: Code Graph RAG Symlink Vulnerability\" \/>\n<meta property=\"og:description\" content=\"CVE-2026-87008 exposes Code Graph RAG to symlink attacks allowing arbitrary file read\/write outside project root via AstGrepService tools.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/i10xnews.kinsta.cloud\/cve-2026-87008-code-graph-rag-symlink-vulnerability\" \/>\n<meta property=\"og:site_name\" content=\"i10X News\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-11T15:24:58+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/cve-2026-87008-code-graph-rag-symlink-vulnerability-title.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1344\" \/>\n\t<meta property=\"og:image:height\" content=\"768\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Christopher Ort\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:site\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Christopher Ort\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-87008-code-graph-rag-symlink-vulnerability#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-87008-code-graph-rag-symlink-vulnerability\"},\"author\":{\"name\":\"Christopher Ort\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\"},\"headline\":\"CVE-2026-87008: Symlink Vulnerability in Code Graph RAG Allows Arbitrary File Read and Write Outside Project Root\",\"datePublished\":\"2026-11-11T15:24:58+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-87008-code-graph-rag-symlink-vulnerability\"},\"wordCount\":775,\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-87008-code-graph-rag-symlink-vulnerability#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-87008-code-graph-rag-symlink-vulnerability-title.webp\",\"articleSection\":[\"Agents\",\"AI Security\",\"Policy &amp; Safety\",\"Security &amp; Defense\"],\"inLanguage\":\"en-US\",\"dateModified\":\"2026-11-11T15:24:58+00:00\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-87008-code-graph-rag-symlink-vulnerability\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-87008-code-graph-rag-symlink-vulnerability\",\"name\":\"CVE-2026-87008: Code Graph RAG Symlink Vulnerability\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-87008-code-graph-rag-symlink-vulnerability#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-87008-code-graph-rag-symlink-vulnerability#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-87008-code-graph-rag-symlink-vulnerability-title.webp\",\"datePublished\":\"2026-11-11T15:24:58+00:00\",\"description\":\"CVE-2026-87008 exposes Code Graph RAG to symlink attacks allowing arbitrary file read\\\/write outside project root via AstGrepService tools.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-87008-code-graph-rag-symlink-vulnerability#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-87008-code-graph-rag-symlink-vulnerability\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-87008-code-graph-rag-symlink-vulnerability#primaryimage\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-87008-code-graph-rag-symlink-vulnerability-title.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-87008-code-graph-rag-symlink-vulnerability-title.webp\",\"width\":1344,\"height\":768,\"caption\":\"A developer's workstation showing terminal windows with file system commands and symbolic links, photographed from over the shoulder in a dimly lit office\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-87008-code-graph-rag-symlink-vulnerability#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/i10x.ai\\\/news\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CVE-2026-87008: Symlink Vulnerability in Code Graph RAG Allows Arbitrary File Read and Write Outside Project Root\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\",\"name\":\"i10X News\",\"description\":\"Stay updated with the latest news and announcements from i10X.\",\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/i10x.ai\\\/news?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\",\"name\":\"i10X\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"contentUrl\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"width\":180,\"height\":180,\"caption\":\"i10X\"},\"image\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/i10x_ai\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/i10x-ai\",\"https:\\\/\\\/instagram.com\\\/i10x.ai\",\"https:\\\/\\\/www.youtube.com\\\/@i10X_ai_official\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\",\"name\":\"Christopher Ort\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"caption\":\"Christopher Ort\"},\"description\":\"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/author\\\/christopher-ort\",\"sameAs\":[\"https:\\\/\\\/i10x.ai\\\/blog\\\/author\\\/christopher-ort\"],\"worksFor\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"alumniOf\":{\"@type\":\"EducationalOrganization\",\"name\":\"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)\",\"url\":\"https:\\\/\\\/www.fau.eu\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CVE-2026-87008: Code Graph RAG Symlink Vulnerability","description":"CVE-2026-87008 exposes Code Graph RAG to symlink attacks allowing arbitrary file read\/write outside project root via AstGrepService tools.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-87008-code-graph-rag-symlink-vulnerability","og_locale":"en_US","og_type":"article","og_title":"CVE-2026-87008: Code Graph RAG Symlink Vulnerability","og_description":"CVE-2026-87008 exposes Code Graph RAG to symlink attacks allowing arbitrary file read\/write outside project root via AstGrepService tools.","og_url":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-87008-code-graph-rag-symlink-vulnerability","og_site_name":"i10X News","article_published_time":"2026-11-11T15:24:58+00:00","og_image":[{"width":1344,"height":768,"url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/cve-2026-87008-code-graph-rag-symlink-vulnerability-title.webp","type":"image\/webp"}],"author":"Christopher Ort","twitter_card":"summary_large_image","twitter_creator":"@i10x_ai","twitter_site":"@i10x_ai","twitter_misc":{"Written by":"Christopher Ort","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-87008-code-graph-rag-symlink-vulnerability#article","isPartOf":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-87008-code-graph-rag-symlink-vulnerability"},"author":{"name":"Christopher Ort","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a"},"headline":"CVE-2026-87008: Symlink Vulnerability in Code Graph RAG Allows Arbitrary File Read and Write Outside Project Root","datePublished":"2026-11-11T15:24:58+00:00","mainEntityOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-87008-code-graph-rag-symlink-vulnerability"},"wordCount":775,"publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-87008-code-graph-rag-symlink-vulnerability#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-87008-code-graph-rag-symlink-vulnerability-title.webp","articleSection":["Agents","AI Security","Policy &amp; Safety","Security &amp; Defense"],"inLanguage":"en-US","dateModified":"2026-11-11T15:24:58+00:00"},{"@type":"WebPage","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-87008-code-graph-rag-symlink-vulnerability","url":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-87008-code-graph-rag-symlink-vulnerability","name":"CVE-2026-87008: Code Graph RAG Symlink Vulnerability","isPartOf":{"@id":"https:\/\/i10x.ai\/news\/#website"},"primaryImageOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-87008-code-graph-rag-symlink-vulnerability#primaryimage"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-87008-code-graph-rag-symlink-vulnerability#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-87008-code-graph-rag-symlink-vulnerability-title.webp","datePublished":"2026-11-11T15:24:58+00:00","description":"CVE-2026-87008 exposes Code Graph RAG to symlink attacks allowing arbitrary file read\/write outside project root via AstGrepService tools.","breadcrumb":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-87008-code-graph-rag-symlink-vulnerability#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/i10xnews.kinsta.cloud\/cve-2026-87008-code-graph-rag-symlink-vulnerability"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-87008-code-graph-rag-symlink-vulnerability#primaryimage","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-87008-code-graph-rag-symlink-vulnerability-title.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-87008-code-graph-rag-symlink-vulnerability-title.webp","width":1344,"height":768,"caption":"A developer's workstation showing terminal windows with file system commands and symbolic links, photographed from over the shoulder in a dimly lit office"},{"@type":"BreadcrumbList","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-87008-code-graph-rag-symlink-vulnerability#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/i10x.ai\/news"},{"@type":"ListItem","position":2,"name":"CVE-2026-87008: Symlink Vulnerability in Code Graph RAG Allows Arbitrary File Read and Write Outside Project Root"}]},{"@type":"WebSite","@id":"https:\/\/i10x.ai\/news\/#website","url":"https:\/\/i10x.ai\/news","name":"i10X News","description":"Stay updated with the latest news and announcements from i10X.","publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/i10x.ai\/news?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/i10x.ai\/news\/#organization","name":"i10X","url":"https:\/\/i10x.ai\/news\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/","url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","contentUrl":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","width":180,"height":180,"caption":"i10X"},"image":{"@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/i10x_ai","https:\/\/www.linkedin.com\/company\/i10x-ai","https:\/\/instagram.com\/i10x.ai","https:\/\/www.youtube.com\/@i10X_ai_official"]},{"@type":"Person","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a","name":"Christopher Ort","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","caption":"Christopher Ort"},"description":"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.","url":"https:\/\/i10x.ai\/news\/author\/christopher-ort","sameAs":["https:\/\/i10x.ai\/blog\/author\/christopher-ort"],"worksFor":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"alumniOf":{"@type":"EducationalOrganization","name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)","url":"https:\/\/www.fau.eu"}}]}},"_links":{"self":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/7202","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/comments?post=7202"}],"version-history":[{"count":0,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/7202\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media\/7201"}],"wp:attachment":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media?parent=7202"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/categories?post=7202"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/tags?post=7202"},{"taxonomy":"company","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/companies?post=7202"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/products?post=7202"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}