agent-coderag: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution
Date: 2026-06
Affected: pip/agent-coderag
Attack vector: rce
Category: vulnerability-disclosure
Severity: High
CWE: CWE-78
CVSS: 8.6 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)

## Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution ### Summary `agent-coderag` unconditionally executes a repository-controlled `gradlew` script during its default `sync` dependency-discovery flow. An attacker who can induce a victim to index a malicious Gradle repository (one containing `build.gradle` and a crafted `gradlew`) achieves arbitrary code execution with the victim's OS privileges. No authentication, no extra flags, and no elevated permissions are required; the attack fires on the default `agent-coderag sync <path>` invocation. ### Details The vulnerability exists across a four-step call chain in the `sync` command: **1. Entry point — `code_rag/entry/cli.py:70`** ```python await manager.sync_dependencies(args.path or ".") ``` `sync_dependencies()` is called unconditionally before indexing. There is no opt-in flag; any `agent-coderag sync` invocation triggers dependency discovery. **2. Gradle project detection — `code_rag/core/manager.py:40-47`** The presence of a `build.gradle` or `build.gradle.kts` file in the target directory is sufficient to invoke `_sync_gradle()`. No additional checks are performed. **3. Wrapper selection — `code_rag/core/manager.py:110-113`** ```python gradle_wrapper = root / ("gradlew.bat" if os.name == "nt" else "gradlew") gradle_bin: Optional[str] = None if gradle_wrapper.exists(): gradle_bin = str(gradle_wrapper.resolve()) else: gradle_bin = shutil.which("gradle") ``` When a reposi


Mitigations:

Architectural layers (MAESTRO):