CVE-2026-57586: CodeRAG is a lightweight semantic code search and distillation utility for AI coding agents. Prior to 1.3.1, the default

CodeRAG, a tool that helps AI coding agents search through code, has a security flaw in versions before 1.3.1 where it automatically runs build files from repositories without checking if they're safe. An attacker can hide malicious code in a fake Gradle repository (a build system for Java projects), and when someone uses CodeRAG to index that repository, the hidden code runs with the user's full system permissions, potentially allowing the attacker to steal data, change files, install backdoors, or crash the system.