GHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read

Summary

The read_file MCP tool in codebase_rag/mcp/tools.py has a path traversal flaw in its paginated branch, triggered when offset or limit is supplied. The handler builds the path with Path(self.project_root) / file_path and never checks that the result stays inside the project root, so an absolute path such as /etc/passwd is read directly. The non-paginated branch is protected by @validate_project_path, but that decorator is not applied on the paginated path, which the source says is left completely unguarded.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Topics

• Model Context Protocol
• Retrieval-augmented generation

Related items

• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
• MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
• MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News
• CriticalCVE-2026-102895: GPUStack Improper Authentication VulnerabilitySimilar attack · CISA Known Exploited Vulnerabilities