High, CVSS 8.6PyPIAmendedPublished
agent-coderag: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution
CVE-2026-57586 · GHSA-wg5p-8h9p-3mr7
- Affected
- PyPI agent-coderag <= 1.3.0
- Fixed in
- 1.3.1· Vendor fix available
- Issue
- Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution Summary agent-coderag unconditionally executes a repository-controlled gradlew script during its default sync dependency-discovery flow. An attacker who can induce a victim to index a malicious Gradle repository (one containing build.gradle and a crafted gradlew) achieves arbitrary code execution with the victim's OS privileges. No authentication, no extra flags, and no elevated permissions are required; the attack fires on the default agent-coderag sync <path invocation. Details The vulnerability exists across a four-step call chain in the sync command: 1. Entry point — coderag/entry/cli.py:70 syncdependencies() is called unconditionally before indexing. There is no opt-in flag; any agent-coderag sync invocation triggers dependency discovery. 2. Gradle project detection — coderag/core/manager.py:40-47 The presence of a build.gradle or build.gradle.kts file in the target directory is sufficient to…
Recommended action: Upgrade to 1.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.