CVE-2026-57586

CodeRAG, a semantic code search and distillation utility for AI coding agents, executes attacker-controlled code when syncing an indexed Gradle project before version 1.3.1. The sync flow in code_rag/entry/cli.py triggers _sync_gradle whenever a build.gradle or build.gradle.kts file is present, and the routine prefers the repository-provided gradlew or gradlew.bat wrapper, passing it directly to asyncio.create_subprocess_exec with the repository root as the working directory. Because path validation only constrains the directory location and never checks the executable's content or integrity, a victim who indexes an attacker-controlled Gradle repository runs the attacker's script with their full operating-system privileges. This enables disclosure, modification, persistence, or denial of service in the victim's environment. The issue is fixed in version 1.3.1, and no public proof of concept or in-the-wild exploitation is known.

What to do: Upgrade CodeRAG to version 1.3.1 or later, where the flaw is fixed. In the meantime, do not run the agent-coderag sync flow against untrusted or third-party repositories, and manually inspect any gradlew/gradlew.bat files in repositories you do index before they are executed. Consider running indexing and sync operations in a sandboxed container with minimal privileges, and review recently indexed repositories for signs of compromise such as unexpected persistence mechanisms or modified files.