Code Graph RAG MCP read_file path traversal lets unauthenticated network caller read arbitrary files on the server

The read_file tool's non-paginated branch uses validate_project_path, but the paginated branch (selected by offset/limit) bypasses that containment check before opening the path, allowing absolute paths and relative traversal to escape the project root. This exposes arbitrary server-readable files to MCP callers.

An AI code-graph/MCP tool that indexes a codebase can be turned into an arbitrary file-read primitive if the workspace guard is bypassed, exposing source, configuration and secrets to a network caller or to a prompt-injected agent session.

The paginated branch of MCPToolsRegistry.read_file joins attacker-controlled file_path to project_root without resolving and verifying containment; an absolute path discards the configured root and relative traversal resolves outside it. An unauthenticated caller of a network-exposed HTTP MCP server can read arbitrary UTF-8-readable files available to the server process, including credentials, env data and private keys.

code-graph-rag < 0.0.345

Upgrade to code-graph-rag 0.0.345. Advisory: https://github.com/vitali87/code-graph-rag/security/advisories/GHSA-vvr2-h2jp-838m