Tools AI Risk Radar ai-incident-0230
Incident record
Graphify indexing could copy local files into agent data
- Severity
- High
- Status
- Patched
- Type
- Infra Vuln
- Target
- Graphify Fortran extractor
- Actor
- researcher
What happened
Indexing an untrusted repository could read files outside that repository and include their contents in the knowledge graph supplied to an agent.
Crafted Fortran include directives escaped the intended input folder when the C preprocessor was installed. The advisory describes local reproduction and a fix in 0.9.70. The maintainer rates the issue High; GitHub’s reviewed record rates it Medium.
Sources
- Maintainer security advisorygithub.com/Graphify-Labs/graphify/security/advisories/GHSA-p…
- GitHub reviewed advisorygithub.com/advisories/GHSA-pcc4-rvhr-2pr8
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 28 October 2026