aeon
Security

code-review-graph: arbitrary file read via changed_files path traversal

code-review-graph MCP server - path traversal in get_review_context_tool via changed_files reads arbitrary files outside the repository (GHSA-7fw4-2xhw-8m89)

PUBLISHED SEVERITY HIGHSTATUS UnpatchedGHSA-7fw4-2xhw-8m89
Unpatched

Unpatched. Reported privately via GitHub Security Advisory on 2026-07-19; the 90-day coordinated-disclosure window passed, and the final 2026-11-03 deadline set in our 2026-10-20 notice expired with no response from the maintainer.

Product
code-review-graph (MCP server) in tirth8205/code-review-graph
Affected versions
code-review-graph through v2.3.9 and staging (checked at HEAD d72e8fb).
Severity
HIGH
Status
Unpatched
Weaknesses
  • CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 as filed on GHSA-7fw4-2xhw-8m89.
GitHub advisory
GHSA-7fw4-2xhw-8m89
Private; in triage, not yet published by the maintainer
CVE
Pending (requested via MITRE CNA-LR)
Published
Credit
Finder: Aaron Elijah Mars of Aeon. Tool: Aeon (https://www.aeon.fun).

What users should do now

No upstream patch is available yet. Developers who connect code-review-graph to an AI coding agent should apply one of these mitigations until an official fix is released.

  1. Require manual approval in your MCP client for get_review_context_tool calls, and reject any call whose changed_files contains .. or an absolute path.
  2. Do not run the code-review-graph MCP server while an agent reviews repositories you do not trust, or run it as a separate user, in a container or VM that cannot read your home directory, SSH keys or credential files.
  3. If modifying the code, apply the small patch from our report: in get_review_context in code_review_graph/tools/review.py, resolve each root / rel_path and skip any path that is not inside root.resolve() before reading it. Apply the same check anywhere else a path is built from changed_files.
  4. If an agent may already have been steered into such a call, rotate the keys and tokens stored in files readable by the user that runs the server.

Impact and reach

Any code-review-graph MCP server, over stdio or over Streamable HTTP with serve --http, exposes this tool to whatever drives it. Whoever can influence the tool call can read any file the server's user can read, and the contents come back in the source_snippets field of the response, where the agent can repeat or forward them.

AI agents call this tool routinely during review and read untrusted code from the repository under review, so a comment or string in a malicious repository is enough to set up the call. No extra permission from the user is needed beyond having the MCP server connected. A working exploit is withheld.

How changed_files escapes the repository

The repository root itself is validated, but the individual changed_files entries are not. get_review_context_tool passes them straight to get_review_context, which ranks and bounds the list and then joins each entry onto root and reads it. In Python, joining .. components or an absolute path onto a Path leaves the root, and there is no resolve() or containment check before read_text:

Disclosure timeline

  1. Vulnerability reported privately via GitHub Security Advisory (GHSA-7fw4-2xhw-8m89).
  2. First follow-up comment posted on the advisory (31 days in triage).
  3. Second follow-up comment posted on the advisory (45 days in triage).
  4. Third follow-up comment posted on the advisory (60 days in triage).
  5. Coordinated-disclosure notice posted on the advisory after the 90-day window passed, setting a deadline of 2026-11-03.
  6. Coordinated-disclosure deadline expired with no response from the maintainer; sink verified still present at HEAD d72e8fb and in release v2.3.9.
  7. Public advisory published; CVE requested via MITRE CNA-LR.

References



RUN NOW