What happened
The AstGrep service's containment check uses unresolved lexical paths, so a symlink inside a repository pointing outside the root is treated as in-scope. The MCP structural tools then follow it to read or overwrite files outside the project root, bypassing the intended approval gate.
Why it matters
An attacker who can get a victim to analyze a repository can plant a symlink that the code-graph RAG agent follows to read credentials/keys/env files or modify sibling source — a workspace-escape primitive in an agentic code-analysis tool.
Attack vector
AstGrepService enumerates files beneath project_root and relies on should_skip_path for containment, but the check operates on unresolved lexical paths. A symbolic link planted inside an analyzed repository can reference a file outside the configured root while appearing in scope; structural_search discloses its content and structural_replace with dry_run=False follows the link and overwrites writable content without the agent-loop approval control.
Affected systems
code-graph-rag < 0.0.589
Mitigation
Upgrade to code-graph-rag 0.0.589. Advisory: https://github.com/vitali87/code-graph-rag/security/advisories/GHSA-85gg-2gfq-q95m