code-graph-rag Approval Bypass via GNU find -exec

Published Advisory Status

GitHub published GHSA-4p93-4vf7-4m8r on August 18, 2026 and credits Regaan R as the reporter. GitHub currently lists no CVE identifier, so the GHSA remains the canonical public identifier until a CVE is allocated.

Field	Published value
Severity	High
CVSS v3.1	7.3 — AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness	CWE-863 — Incorrect Authorization
Affected versions	<= 0.0.669
Patched version	0.0.670
CVE status	Pending assignment

Vulnerability Summary

code-graph-rag treated find as a read-only command based on the first executable token. GNU find, however, can start another program through action operands such as -exec and -execdir.

This mismatch allowed a tool call beginning with an approved find command to launch a normally blocked shell command while tool_call_approved remained false. The invoked program was also able to write outside the configured project root.

Security Boundary Failure

The issue crossed two intended default-mode boundaries:

• write-capable shell operations could execute without explicit confirmation;
• tool activity could escape the configured project directory.

In an AI-assisted workflow, a malicious instruction embedded in analyzed content, a prompt injection, or an incorrect model-generated tool call could therefore execute commands with the privileges of the code-graph-rag process. Possible consequences include modification of user files, access to process-readable credentials, and network activity.

Root Cause

The command policy classified find as both allowed and read-only. Approval logic examined the base executable but did not parse action-bearing operands such as -exec, -execdir, and -delete. Execution therefore proceeded even though the nested program was not independently approved.

The proof of concept was validated against:

• code-graph-rag version 0.0.613;
• commit a189c9a8f8c1081a7ec2a57665390b6ff043d7ea;
• Linux with GNU find.

Proof-of-Concept Evidence

The regression test ran the real shell tool with approval disabled. It demonstrated that GNU find launched sh, returned exit code 0, and created a marker outside the configured project root.

The minimal command shape was:

find . -maxdepth 0 -exec sh -c \
  'printf cgr-find-exec-bypass > /tmp/find-exec-bypass.txt' \;

Run reproduction tests only in a disposable local environment that you own or are explicitly authorized to assess.

Resolution

Version 0.0.670 is listed as patched. Users should upgrade to that version or later.

For command-policy implementations, the durable fix is to validate the complete command grammar rather than trusting the executable name alone. Action-capable operands must trigger approval, nested executables must be evaluated independently, and project-root confinement should be enforced at execution time.

Reference

• GitHub Security Advisory GHSA-4p93-4vf7-4m8r