Answer in brief
CVE-2026-57586 records a High severity (CVSS 8.6) vulnerability in CodeRAG: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution. The current sources do not mark it as known exploited. The current feed maps naranor/agent-coderag (generic), agent-coderag (pip), agent-coderag (pypi). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.6. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps naranor/agent-coderag (generic), agent-coderag (pip), agent-coderag (pypi). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| naranor/agent-coderaggeneric | <1.3.1 | 1.3.1 |
| agent-coderagpip | <=1.3.0 | 1.3.1 |
| agent-coderagpypi | >=0 <1.3.1 | 1.3.1 |
Published upstream
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 19, 2026
CodeRAG is a lightweight semantic code search and distillation utility for AI coding agents. Prior to 1.3.1, the default agent-coderag sync flow in code_rag/entry/cli.py calls sync_dependencies for an indexed path, and code_rag/core/manager.py treats build.gradle or build.gradle.kts as sufficient to invoke _sync_gradle. _sync_gradle prefers a repository-controlled gradlew or gradlew.bat file and passes it directly to asyncio.create_subprocess_exec with the repository root as the working directory; validate_path in code_rag/core/utils.py constrains the directory location but does not validate the executable's content or integrity. A victim who indexes an attacker-controlled Gradle repository therefore executes attacker-supplied code with the victim's operating-system privileges, allowing disclosure, modification, persistence, or denial of service in the user environment. This issue is fixed in 1.3.1.
Quoted source text, attributed separately from HOL analysis.