Agent Coderag
Monthly
Agent-coderag versions up to and including 1.3.0 execute a repository-supplied Gradle wrapper during the default `agent-coderag sync` dependency-discovery flow, letting an attacker who plants a malicious `gradlew` in a Gradle project run arbitrary code with the victim's operating-system privileges. The flaw is a command-injection design error (CWE-78) in `code_rag/core/manager.py`, where a repository-local `gradlew` is unconditionally preferred over the system `gradle` binary and passed to `asyncio.create_subprocess_exec`; CVSS 3.1 base 8.6 with user interaction required (UI:R) because the victim must index the hostile repository. Upstream fixed the issue in 1.3.1 by using only the PATH-resolved system `gradle`; no public exploit code has been identified and the CVE is not in CISA KEV at time of analysis.
Agent-coderag versions up to and including 1.3.0 execute a repository-supplied Gradle wrapper during the default `agent-coderag sync` dependency-discovery flow, letting an attacker who plants a malicious `gradlew` in a Gradle project run arbitrary code with the victim's operating-system privileges. The flaw is a command-injection design error (CWE-78) in `code_rag/core/manager.py`, where a repository-local `gradlew` is unconditionally preferred over the system `gradle` binary and passed to `asyncio.create_subprocess_exec`; CVSS 3.1 base 8.6 with user interaction required (UI:R) because the victim must index the hostile repository. Upstream fixed the issue in 1.3.1 by using only the PATH-resolved system `gradle`; no public exploit code has been identified and the CVE is not in CISA KEV at time of analysis.