Secuno
ENNL
Book demo

CVE-2026-57586

8.6 HIGH
  1. Published15 Sept 2026

Description

CodeRAG is a lightweight semantic code search and distillation utility for AI coding agents. Prior to 1.3.1, the default agent-coderag sync flow in code_rag/entry/cli.py calls sync_dependencies for an indexed path, and code_rag/core/manager.py treats build.gradle or build.gradle.kts as sufficient to invoke _sync_gradle. _sync_gradle prefers a repository-controlled gradlew or gradlew.bat file and passes it directly to asyncio.create_subprocess_exec with the repository root as the working directory; validate_path in code_rag/core/utils.py constrains the directory location but does not validate the executable's content or integrity. A victim who indexes an attacker-controlled Gradle repository therefore executes attacker-supplied code with the victim's operating-system privileges, allowing disclosure, modification, persistence, or denial of service in the user environment. This issue is fixed in 1.3.1.

CVSS 3.1 breakdown

Attack vectorLocal
Attack complexityLow
Privileges requiredNone
User interactionRequired
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-524848.8
An issue in MitraStar GPT-2742GX4X5v6-SV GL_g2.5_100XNT0b23_3 allows an authenticated…
CVE-2026-919318.5
Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP…
CVE-2026-551589.1
Conflibot warns in advance when merging a pull request will cause conflicts in other…
CVE-2026-571368.8
PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, CommandValidator in…
CVE-2026-571338.8
PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, the shell() helper…
CVE-2026-908479.1
A vulnerability was determined in EFM ipTIME C200E 1.094. The impacted element is an…

Frequently asked

Is CVE-2026-57586 being actively exploited?

CVE-2026-57586 is not in the CISA KEV catalog.

How severe is CVE-2026-57586?

CVE-2026-57586 has a CVSS 3.1 base score of 8.6, rated high.

How do I fix CVE-2026-57586?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-57586 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.