GHSA-wg5p-8h9p-3mr7

## Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution ### Summary `agent-coderag` unconditionally executes a repository-controlled `gradlew` script during its default `sync` dependency-discovery flow. An attacker who can induce a victim to index a malicious Gradle repository (one containing `build.gradle` and a crafted `gradlew`) achieves arbitrary code execution with the victim's OS privileges. No authentication, no extra flags, and no elevated permissions are required; the attack fires on the default `agent-coderag sync <path>` invocation. ### Details The vulnerability exists across a four-step call chain in the `sync` command: **1. Entry point — `code_rag/entry/cli.py:70`** ```python await manager.sync_dependencies(args.path or ".") ``` `sync_dependencies()` is called unconditionally before indexing. There is no opt-in flag; any `agent-coderag sync` invocation triggers dependency discovery. **2. Gradle project detection — `code_rag/core/manager.py:40-47`** The presence of a `build.gradle` or `build.gradle.kts` file in the target directory is sufficient to invoke `_sync_gradle()`. No additional checks are performed. **3. Wrapper selection — `code_rag/core/manager.py:110-113`** ```python gradle_wrapper = root / ("gradlew.bat" if os.name == "nt" else "gradlew") gradle_bin: Optional[str] = None if gradle_wrapper.exists(): gradle_bin = str(gradle_wrapper.resolve()) else: gradle_bin = shutil.which("gradle") ``` When a repository-local `gradlew` exists, it is unconditionally preferred over the system-installed `gradle`. No content validation, signature check, or integrity verification is performed on this file. **4. Execution sink — `code_rag/core/manager.py:152-158`** ```python process = await asyncio.create_subprocess_exec( gradle_bin, "-q", "--init-script", str(init_script), "printCodeRagCP", cwd=str(root), ... ) ``` The attacker-controlled `gradlew` is executed directly via `asynci