graphifyy
Turn any codebase, with its docs, SQL schemas, configs, and PDFs, into a queryable knowledge graph. A /graphify skill for Claude Code, Cursor, Codex, and Gemini CLI: local deterministic AST parsing, every edge explained, no vector store.
View on Github
Activity
- Latest release
- 2h ago
- Total releases
- 267
- Cadence
- ~daily
- Last 12 months
- 267
Reach
- Stars
- 139.2k
Details
- License
- Apache-2.0
- First release
- Apr 04, 2026
| Version | Released | |
|---|---|---|
0.9.99
patch
| ||
0.9.98
patch
| ||
0.9.97
patch
| ||
0.9.96
patch
| ||
0.9.95
patch
| ||
0.9.94
patch
| ||
0.9.93
patch
| ||
0.9.92
patch
| ||
0.9.91
patch
| ||
0.9.90
patch
| ||
0.9.89
patch
| ||
0.9.88
patch
| ||
0.9.87
patch
| ||
0.9.86
patch
| ||
0.9.85
patch
| ||
0.9.84
patch
| ||
0.9.83
patch
| ||
0.9.82
patch
| ||
0.9.81
patch
| ||
0.9.80
patch
| ||
0.9.79
patch
| ||
0.9.78
patch
| ||
0.9.77
patch
| ||
0.9.76
patch
| ||
0.9.75
patch
| ||
0.9.74
patch
| ||
0.9.73
patch
| ||
0.9.72
patch
| ||
0.9.71
patch
| ||
0.9.70
patch
| ||
0.9.69
patch
1 CVE
GHSA-pcc4-rvhr-2pr8
Oct 19, 2026
Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo
Medium
Local
Low
None
SummaryThe Fortran extractor's C-preprocessor step ( This is the exact "corpus-side file-exfiltration vector" the F-007 comment says it is defending against; the mitigation is bypassable. SeverityHigh. Arbitrary local-file read on the host, triggered by graphify's core action (indexing an untrusted folder — "turn any folder of code ... into a queryable knowledge graph"), defeating a documented security control. It runs on the default, offline, no-API-key AST path ( Where
Reached from Why the mitigation does not work
Proof of concept (verified)Reproduced against the shipped code with the exact command Secret on disk ( (a) Absolute include — (b) Relative traversal — Both produce preprocessed output containing the full secret file contents ( Surfacing into the graph —
Fidelity note: Fortran is case-insensitive, so captured identifiers are lower-cased. Case-insensitive secrets (file paths, hostnames, usernames, hex tokens, connection-string fragments, and the mere existence/partial content of a readable file) leak cleanly; high-entropy case-sensitive blobs (base64/JWT) are partially corrupted by the lower-casing but still confirm readability and structure. Single-token-per-line secret files (API-key files, single-line credential/token files) leak that token in full (lower-cased). Requires Suggested fixMirror the containment approach already used elsewhere in the codebase (
A blunter but safe alternative is to strip all Detected byAeon vuln-scanner. Semgrep flagged the Fortran subprocess path; manual review of the F-007 mitigation plus an empirical Affected versions
0.7.10
0.7.11
0.7.13
0.7.14
0.7.15
0.7.16
0.7.17
0.7.18
0.7.19
0.7.2
0.7.3
0.7.4
+ 124 more Show less
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.1
0.8.10
0.8.11
0.8.13
0.8.14
0.8.15
0.8.16
0.8.17
0.8.18
0.8.19
0.8.2
0.8.20
0.8.21
0.8.22
0.8.24
0.8.25
0.8.26
0.8.27
0.8.28
0.8.29
0.8.3
0.8.30
0.8.31
0.8.32
0.8.33
0.8.34
0.8.35
0.8.36
0.8.37
0.8.38
0.8.39
0.8.4
0.8.40
0.8.41
0.8.42
0.8.43
0.8.44
0.8.45
0.8.46
0.8.47
0.8.48
0.8.49
0.8.5
0.8.50
0.8.51
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.11
0.9.12
0.9.13
0.9.14
0.9.15
0.9.16
0.9.17
0.9.18
0.9.19
0.9.2
0.9.20
0.9.21
0.9.22
0.9.23
0.9.24
0.9.25
0.9.26
0.9.27
0.9.28
0.9.29
0.9.3
0.9.30
0.9.31
0.9.32
0.9.33
0.9.34
0.9.35
0.9.36
0.9.37
0.9.38
0.9.39
0.9.4
0.9.40
0.9.41
0.9.42
0.9.43
0.9.44
0.9.45
0.9.46
0.9.47
0.9.48
0.9.49
0.9.5
0.9.50
0.9.51
0.9.52
0.9.53
0.9.54
0.9.55
0.9.56
0.9.57
0.9.58
0.9.59
0.9.6
0.9.60
0.9.61
0.9.62
0.9.63
0.9.64
0.9.65
0.9.66
0.9.67
0.9.68
0.9.69
0.9.7
0.9.8
0.9.9
Fixed in
0.9.70
References Updated Oct 19, 2026 · Source: OSV.dev | ||
0.9.68
patch
1 CVE
GHSA-pcc4-rvhr-2pr8
Oct 19, 2026
Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo
Medium
Local
Low
None
SummaryThe Fortran extractor's C-preprocessor step ( This is the exact "corpus-side file-exfiltration vector" the F-007 comment says it is defending against; the mitigation is bypassable. SeverityHigh. Arbitrary local-file read on the host, triggered by graphify's core action (indexing an untrusted folder — "turn any folder of code ... into a queryable knowledge graph"), defeating a documented security control. It runs on the default, offline, no-API-key AST path ( Where
Reached from Why the mitigation does not work
Proof of concept (verified)Reproduced against the shipped code with the exact command Secret on disk ( (a) Absolute include — (b) Relative traversal — Both produce preprocessed output containing the full secret file contents ( Surfacing into the graph —
Fidelity note: Fortran is case-insensitive, so captured identifiers are lower-cased. Case-insensitive secrets (file paths, hostnames, usernames, hex tokens, connection-string fragments, and the mere existence/partial content of a readable file) leak cleanly; high-entropy case-sensitive blobs (base64/JWT) are partially corrupted by the lower-casing but still confirm readability and structure. Single-token-per-line secret files (API-key files, single-line credential/token files) leak that token in full (lower-cased). Requires Suggested fixMirror the containment approach already used elsewhere in the codebase (
A blunter but safe alternative is to strip all Detected byAeon vuln-scanner. Semgrep flagged the Fortran subprocess path; manual review of the F-007 mitigation plus an empirical Affected versions
0.7.10
0.7.11
0.7.13
0.7.14
0.7.15
0.7.16
0.7.17
0.7.18
0.7.19
0.7.2
0.7.3
0.7.4
+ 124 more Show less
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.1
0.8.10
0.8.11
0.8.13
0.8.14
0.8.15
0.8.16
0.8.17
0.8.18
0.8.19
0.8.2
0.8.20
0.8.21
0.8.22
0.8.24
0.8.25
0.8.26
0.8.27
0.8.28
0.8.29
0.8.3
0.8.30
0.8.31
0.8.32
0.8.33
0.8.34
0.8.35
0.8.36
0.8.37
0.8.38
0.8.39
0.8.4
0.8.40
0.8.41
0.8.42
0.8.43
0.8.44
0.8.45
0.8.46
0.8.47
0.8.48
0.8.49
0.8.5
0.8.50
0.8.51
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.11
0.9.12
0.9.13
0.9.14
0.9.15
0.9.16
0.9.17
0.9.18
0.9.19
0.9.2
0.9.20
0.9.21
0.9.22
0.9.23
0.9.24
0.9.25
0.9.26
0.9.27
0.9.28
0.9.29
0.9.3
0.9.30
0.9.31
0.9.32
0.9.33
0.9.34
0.9.35
0.9.36
0.9.37
0.9.38
0.9.39
0.9.4
0.9.40
0.9.41
0.9.42
0.9.43
0.9.44
0.9.45
0.9.46
0.9.47
0.9.48
0.9.49
0.9.5
0.9.50
0.9.51
0.9.52
0.9.53
0.9.54
0.9.55
0.9.56
0.9.57
0.9.58
0.9.59
0.9.6
0.9.60
0.9.61
0.9.62
0.9.63
0.9.64
0.9.65
0.9.66
0.9.67
0.9.68
0.9.69
0.9.7
0.9.8
0.9.9
Fixed in
0.9.70
References Updated Oct 19, 2026 · Source: OSV.dev | ||
0.9.67
patch
1 CVE
GHSA-pcc4-rvhr-2pr8
Oct 19, 2026
Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo
Medium
Local
Low
None
SummaryThe Fortran extractor's C-preprocessor step ( This is the exact "corpus-side file-exfiltration vector" the F-007 comment says it is defending against; the mitigation is bypassable. SeverityHigh. Arbitrary local-file read on the host, triggered by graphify's core action (indexing an untrusted folder — "turn any folder of code ... into a queryable knowledge graph"), defeating a documented security control. It runs on the default, offline, no-API-key AST path ( Where
Reached from Why the mitigation does not work
Proof of concept (verified)Reproduced against the shipped code with the exact command Secret on disk ( (a) Absolute include — (b) Relative traversal — Both produce preprocessed output containing the full secret file contents ( Surfacing into the graph —
Fidelity note: Fortran is case-insensitive, so captured identifiers are lower-cased. Case-insensitive secrets (file paths, hostnames, usernames, hex tokens, connection-string fragments, and the mere existence/partial content of a readable file) leak cleanly; high-entropy case-sensitive blobs (base64/JWT) are partially corrupted by the lower-casing but still confirm readability and structure. Single-token-per-line secret files (API-key files, single-line credential/token files) leak that token in full (lower-cased). Requires Suggested fixMirror the containment approach already used elsewhere in the codebase (
A blunter but safe alternative is to strip all Detected byAeon vuln-scanner. Semgrep flagged the Fortran subprocess path; manual review of the F-007 mitigation plus an empirical Affected versions
0.7.10
0.7.11
0.7.13
0.7.14
0.7.15
0.7.16
0.7.17
0.7.18
0.7.19
0.7.2
0.7.3
0.7.4
+ 124 more Show less
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.1
0.8.10
0.8.11
0.8.13
0.8.14
0.8.15
0.8.16
0.8.17
0.8.18
0.8.19
0.8.2
0.8.20
0.8.21
0.8.22
0.8.24
0.8.25
0.8.26
0.8.27
0.8.28
0.8.29
0.8.3
0.8.30
0.8.31
0.8.32
0.8.33
0.8.34
0.8.35
0.8.36
0.8.37
0.8.38
0.8.39
0.8.4
0.8.40
0.8.41
0.8.42
0.8.43
0.8.44
0.8.45
0.8.46
0.8.47
0.8.48
0.8.49
0.8.5
0.8.50
0.8.51
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.11
0.9.12
0.9.13
0.9.14
0.9.15
0.9.16
0.9.17
0.9.18
0.9.19
0.9.2
0.9.20
0.9.21
0.9.22
0.9.23
0.9.24
0.9.25
0.9.26
0.9.27
0.9.28
0.9.29
0.9.3
0.9.30
0.9.31
0.9.32
0.9.33
0.9.34
0.9.35
0.9.36
0.9.37
0.9.38
0.9.39
0.9.4
0.9.40
0.9.41
0.9.42
0.9.43
0.9.44
0.9.45
0.9.46
0.9.47
0.9.48
0.9.49
0.9.5
0.9.50
0.9.51
0.9.52
0.9.53
0.9.54
0.9.55
0.9.56
0.9.57
0.9.58
0.9.59
0.9.6
0.9.60
0.9.61
0.9.62
0.9.63
0.9.64
0.9.65
0.9.66
0.9.67
0.9.68
0.9.69
0.9.7
0.9.8
0.9.9
Fixed in
0.9.70
References Updated Oct 19, 2026 · Source: OSV.dev | ||
0.9.66
patch
1 CVE
GHSA-pcc4-rvhr-2pr8
Oct 19, 2026
Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo
Medium
Local
Low
None
SummaryThe Fortran extractor's C-preprocessor step ( This is the exact "corpus-side file-exfiltration vector" the F-007 comment says it is defending against; the mitigation is bypassable. SeverityHigh. Arbitrary local-file read on the host, triggered by graphify's core action (indexing an untrusted folder — "turn any folder of code ... into a queryable knowledge graph"), defeating a documented security control. It runs on the default, offline, no-API-key AST path ( Where
Reached from Why the mitigation does not work
Proof of concept (verified)Reproduced against the shipped code with the exact command Secret on disk ( (a) Absolute include — (b) Relative traversal — Both produce preprocessed output containing the full secret file contents ( Surfacing into the graph —
Fidelity note: Fortran is case-insensitive, so captured identifiers are lower-cased. Case-insensitive secrets (file paths, hostnames, usernames, hex tokens, connection-string fragments, and the mere existence/partial content of a readable file) leak cleanly; high-entropy case-sensitive blobs (base64/JWT) are partially corrupted by the lower-casing but still confirm readability and structure. Single-token-per-line secret files (API-key files, single-line credential/token files) leak that token in full (lower-cased). Requires Suggested fixMirror the containment approach already used elsewhere in the codebase (
A blunter but safe alternative is to strip all Detected byAeon vuln-scanner. Semgrep flagged the Fortran subprocess path; manual review of the F-007 mitigation plus an empirical Affected versions
0.7.10
0.7.11
0.7.13
0.7.14
0.7.15
0.7.16
0.7.17
0.7.18
0.7.19
0.7.2
0.7.3
0.7.4
+ 124 more Show less
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.1
0.8.10
0.8.11
0.8.13
0.8.14
0.8.15
0.8.16
0.8.17
0.8.18
0.8.19
0.8.2
0.8.20
0.8.21
0.8.22
0.8.24
0.8.25
0.8.26
0.8.27
0.8.28
0.8.29
0.8.3
0.8.30
0.8.31
0.8.32
0.8.33
0.8.34
0.8.35
0.8.36
0.8.37
0.8.38
0.8.39
0.8.4
0.8.40
0.8.41
0.8.42
0.8.43
0.8.44
0.8.45
0.8.46
0.8.47
0.8.48
0.8.49
0.8.5
0.8.50
0.8.51
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.11
0.9.12
0.9.13
0.9.14
0.9.15
0.9.16
0.9.17
0.9.18
0.9.19
0.9.2
0.9.20
0.9.21
0.9.22
0.9.23
0.9.24
0.9.25
0.9.26
0.9.27
0.9.28
0.9.29
0.9.3
0.9.30
0.9.31
0.9.32
0.9.33
0.9.34
0.9.35
0.9.36
0.9.37
0.9.38
0.9.39
0.9.4
0.9.40
0.9.41
0.9.42
0.9.43
0.9.44
0.9.45
0.9.46
0.9.47
0.9.48
0.9.49
0.9.5
0.9.50
0.9.51
0.9.52
0.9.53
0.9.54
0.9.55
0.9.56
0.9.57
0.9.58
0.9.59
0.9.6
0.9.60
0.9.61
0.9.62
0.9.63
0.9.64
0.9.65
0.9.66
0.9.67
0.9.68
0.9.69
0.9.7
0.9.8
0.9.9
Fixed in
0.9.70
References Updated Oct 19, 2026 · Source: OSV.dev | ||
0.9.65
patch
1 CVE
GHSA-pcc4-rvhr-2pr8
Oct 19, 2026
Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo
Medium
Local
Low
None
SummaryThe Fortran extractor's C-preprocessor step ( This is the exact "corpus-side file-exfiltration vector" the F-007 comment says it is defending against; the mitigation is bypassable. SeverityHigh. Arbitrary local-file read on the host, triggered by graphify's core action (indexing an untrusted folder — "turn any folder of code ... into a queryable knowledge graph"), defeating a documented security control. It runs on the default, offline, no-API-key AST path ( Where
Reached from Why the mitigation does not work
Proof of concept (verified)Reproduced against the shipped code with the exact command Secret on disk ( (a) Absolute include — (b) Relative traversal — Both produce preprocessed output containing the full secret file contents ( Surfacing into the graph —
Fidelity note: Fortran is case-insensitive, so captured identifiers are lower-cased. Case-insensitive secrets (file paths, hostnames, usernames, hex tokens, connection-string fragments, and the mere existence/partial content of a readable file) leak cleanly; high-entropy case-sensitive blobs (base64/JWT) are partially corrupted by the lower-casing but still confirm readability and structure. Single-token-per-line secret files (API-key files, single-line credential/token files) leak that token in full (lower-cased). Requires Suggested fixMirror the containment approach already used elsewhere in the codebase (
A blunter but safe alternative is to strip all Detected byAeon vuln-scanner. Semgrep flagged the Fortran subprocess path; manual review of the F-007 mitigation plus an empirical Affected versions
0.7.10
0.7.11
0.7.13
0.7.14
0.7.15
0.7.16
0.7.17
0.7.18
0.7.19
0.7.2
0.7.3
0.7.4
+ 124 more Show less
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.1
0.8.10
0.8.11
0.8.13
0.8.14
0.8.15
0.8.16
0.8.17
0.8.18
0.8.19
0.8.2
0.8.20
0.8.21
0.8.22
0.8.24
0.8.25
0.8.26
0.8.27
0.8.28
0.8.29
0.8.3
0.8.30
0.8.31
0.8.32
0.8.33
0.8.34
0.8.35
0.8.36
0.8.37
0.8.38
0.8.39
0.8.4
0.8.40
0.8.41
0.8.42
0.8.43
0.8.44
0.8.45
0.8.46
0.8.47
0.8.48
0.8.49
0.8.5
0.8.50
0.8.51
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.11
0.9.12
0.9.13
0.9.14
0.9.15
0.9.16
0.9.17
0.9.18
0.9.19
0.9.2
0.9.20
0.9.21
0.9.22
0.9.23
0.9.24
0.9.25
0.9.26
0.9.27
0.9.28
0.9.29
0.9.3
0.9.30
0.9.31
0.9.32
0.9.33
0.9.34
0.9.35
0.9.36
0.9.37
0.9.38
0.9.39
0.9.4
0.9.40
0.9.41
0.9.42
0.9.43
0.9.44
0.9.45
0.9.46
0.9.47
0.9.48
0.9.49
0.9.5
0.9.50
0.9.51
0.9.52
0.9.53
0.9.54
0.9.55
0.9.56
0.9.57
0.9.58
0.9.59
0.9.6
0.9.60
0.9.61
0.9.62
0.9.63
0.9.64
0.9.65
0.9.66
0.9.67
0.9.68
0.9.69
0.9.7
0.9.8
0.9.9
Fixed in
0.9.70
References Updated Oct 19, 2026 · Source: OSV.dev | ||
0.9.64
patch
1 CVE
GHSA-pcc4-rvhr-2pr8
Oct 19, 2026
Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo
Medium
Local
Low
None
SummaryThe Fortran extractor's C-preprocessor step ( This is the exact "corpus-side file-exfiltration vector" the F-007 comment says it is defending against; the mitigation is bypassable. SeverityHigh. Arbitrary local-file read on the host, triggered by graphify's core action (indexing an untrusted folder — "turn any folder of code ... into a queryable knowledge graph"), defeating a documented security control. It runs on the default, offline, no-API-key AST path ( Where
Reached from Why the mitigation does not work
Proof of concept (verified)Reproduced against the shipped code with the exact command Secret on disk ( (a) Absolute include — (b) Relative traversal — Both produce preprocessed output containing the full secret file contents ( Surfacing into the graph —
Fidelity note: Fortran is case-insensitive, so captured identifiers are lower-cased. Case-insensitive secrets (file paths, hostnames, usernames, hex tokens, connection-string fragments, and the mere existence/partial content of a readable file) leak cleanly; high-entropy case-sensitive blobs (base64/JWT) are partially corrupted by the lower-casing but still confirm readability and structure. Single-token-per-line secret files (API-key files, single-line credential/token files) leak that token in full (lower-cased). Requires Suggested fixMirror the containment approach already used elsewhere in the codebase (
A blunter but safe alternative is to strip all Detected byAeon vuln-scanner. Semgrep flagged the Fortran subprocess path; manual review of the F-007 mitigation plus an empirical Affected versions
0.7.10
0.7.11
0.7.13
0.7.14
0.7.15
0.7.16
0.7.17
0.7.18
0.7.19
0.7.2
0.7.3
0.7.4
+ 124 more Show less
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.1
0.8.10
0.8.11
0.8.13
0.8.14
0.8.15
0.8.16
0.8.17
0.8.18
0.8.19
0.8.2
0.8.20
0.8.21
0.8.22
0.8.24
0.8.25
0.8.26
0.8.27
0.8.28
0.8.29
0.8.3
0.8.30
0.8.31
0.8.32
0.8.33
0.8.34
0.8.35
0.8.36
0.8.37
0.8.38
0.8.39
0.8.4
0.8.40
0.8.41
0.8.42
0.8.43
0.8.44
0.8.45
0.8.46
0.8.47
0.8.48
0.8.49
0.8.5
0.8.50
0.8.51
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.11
0.9.12
0.9.13
0.9.14
0.9.15
0.9.16
0.9.17
0.9.18
0.9.19
0.9.2
0.9.20
0.9.21
0.9.22
0.9.23
0.9.24
0.9.25
0.9.26
0.9.27
0.9.28
0.9.29
0.9.3
0.9.30
0.9.31
0.9.32
0.9.33
0.9.34
0.9.35
0.9.36
0.9.37
0.9.38
0.9.39
0.9.4
0.9.40
0.9.41
0.9.42
0.9.43
0.9.44
0.9.45
0.9.46
0.9.47
0.9.48
0.9.49
0.9.5
0.9.50
0.9.51
0.9.52
0.9.53
0.9.54
0.9.55
0.9.56
0.9.57
0.9.58
0.9.59
0.9.6
0.9.60
0.9.61
0.9.62
0.9.63
0.9.64
0.9.65
0.9.66
0.9.67
0.9.68
0.9.69
0.9.7
0.9.8
0.9.9
Fixed in
0.9.70
References Updated Oct 19, 2026 · Source: OSV.dev | ||
0.9.63
patch
1 CVE
GHSA-pcc4-rvhr-2pr8
Oct 19, 2026
Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo
Medium
Local
Low
None
SummaryThe Fortran extractor's C-preprocessor step ( This is the exact "corpus-side file-exfiltration vector" the F-007 comment says it is defending against; the mitigation is bypassable. SeverityHigh. Arbitrary local-file read on the host, triggered by graphify's core action (indexing an untrusted folder — "turn any folder of code ... into a queryable knowledge graph"), defeating a documented security control. It runs on the default, offline, no-API-key AST path ( Where
Reached from Why the mitigation does not work
Proof of concept (verified)Reproduced against the shipped code with the exact command Secret on disk ( (a) Absolute include — (b) Relative traversal — Both produce preprocessed output containing the full secret file contents ( Surfacing into the graph —
Fidelity note: Fortran is case-insensitive, so captured identifiers are lower-cased. Case-insensitive secrets (file paths, hostnames, usernames, hex tokens, connection-string fragments, and the mere existence/partial content of a readable file) leak cleanly; high-entropy case-sensitive blobs (base64/JWT) are partially corrupted by the lower-casing but still confirm readability and structure. Single-token-per-line secret files (API-key files, single-line credential/token files) leak that token in full (lower-cased). Requires Suggested fixMirror the containment approach already used elsewhere in the codebase (
A blunter but safe alternative is to strip all Detected byAeon vuln-scanner. Semgrep flagged the Fortran subprocess path; manual review of the F-007 mitigation plus an empirical Affected versions
0.7.10
0.7.11
0.7.13
0.7.14
0.7.15
0.7.16
0.7.17
0.7.18
0.7.19
0.7.2
0.7.3
0.7.4
+ 124 more Show less
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.1
0.8.10
0.8.11
0.8.13
0.8.14
0.8.15
0.8.16
0.8.17
0.8.18
0.8.19
0.8.2
0.8.20
0.8.21
0.8.22
0.8.24
0.8.25
0.8.26
0.8.27
0.8.28
0.8.29
0.8.3
0.8.30
0.8.31
0.8.32
0.8.33
0.8.34
0.8.35
0.8.36
0.8.37
0.8.38
0.8.39
0.8.4
0.8.40
0.8.41
0.8.42
0.8.43
0.8.44
0.8.45
0.8.46
0.8.47
0.8.48
0.8.49
0.8.5
0.8.50
0.8.51
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.11
0.9.12
0.9.13
0.9.14
0.9.15
0.9.16
0.9.17
0.9.18
0.9.19
0.9.2
0.9.20
0.9.21
0.9.22
0.9.23
0.9.24
0.9.25
0.9.26
0.9.27
0.9.28
0.9.29
0.9.3
0.9.30
0.9.31
0.9.32
0.9.33
0.9.34
0.9.35
0.9.36
0.9.37
0.9.38
0.9.39
0.9.4
0.9.40
0.9.41
0.9.42
0.9.43
0.9.44
0.9.45
0.9.46
0.9.47
0.9.48
0.9.49
0.9.5
0.9.50
0.9.51
0.9.52
0.9.53
0.9.54
0.9.55
0.9.56
0.9.57
0.9.58
0.9.59
0.9.6
0.9.60
0.9.61
0.9.62
0.9.63
0.9.64
0.9.65
0.9.66
0.9.67
0.9.68
0.9.69
0.9.7
0.9.8
0.9.9
Fixed in
0.9.70
References Updated Oct 19, 2026 · Source: OSV.dev | ||
0.9.62
patch
1 CVE
GHSA-pcc4-rvhr-2pr8
Oct 19, 2026
Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo
Medium
Local
Low
None
SummaryThe Fortran extractor's C-preprocessor step ( This is the exact "corpus-side file-exfiltration vector" the F-007 comment says it is defending against; the mitigation is bypassable. SeverityHigh. Arbitrary local-file read on the host, triggered by graphify's core action (indexing an untrusted folder — "turn any folder of code ... into a queryable knowledge graph"), defeating a documented security control. It runs on the default, offline, no-API-key AST path ( Where
Reached from Why the mitigation does not work
Proof of concept (verified)Reproduced against the shipped code with the exact command Secret on disk ( (a) Absolute include — (b) Relative traversal — Both produce preprocessed output containing the full secret file contents ( Surfacing into the graph —
Fidelity note: Fortran is case-insensitive, so captured identifiers are lower-cased. Case-insensitive secrets (file paths, hostnames, usernames, hex tokens, connection-string fragments, and the mere existence/partial content of a readable file) leak cleanly; high-entropy case-sensitive blobs (base64/JWT) are partially corrupted by the lower-casing but still confirm readability and structure. Single-token-per-line secret files (API-key files, single-line credential/token files) leak that token in full (lower-cased). Requires Suggested fixMirror the containment approach already used elsewhere in the codebase (
A blunter but safe alternative is to strip all Detected byAeon vuln-scanner. Semgrep flagged the Fortran subprocess path; manual review of the F-007 mitigation plus an empirical Affected versions
0.7.10
0.7.11
0.7.13
0.7.14
0.7.15
0.7.16
0.7.17
0.7.18
0.7.19
0.7.2
0.7.3
0.7.4
+ 124 more Show less
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.1
0.8.10
0.8.11
0.8.13
0.8.14
0.8.15
0.8.16
0.8.17
0.8.18
0.8.19
0.8.2
0.8.20
0.8.21
0.8.22
0.8.24
0.8.25
0.8.26
0.8.27
0.8.28
0.8.29
0.8.3
0.8.30
0.8.31
0.8.32
0.8.33
0.8.34
0.8.35
0.8.36
0.8.37
0.8.38
0.8.39
0.8.4
0.8.40
0.8.41
0.8.42
0.8.43
0.8.44
0.8.45
0.8.46
0.8.47
0.8.48
0.8.49
0.8.5
0.8.50
0.8.51
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.11
0.9.12
0.9.13
0.9.14
0.9.15
0.9.16
0.9.17
0.9.18
0.9.19
0.9.2
0.9.20
0.9.21
0.9.22
0.9.23
0.9.24
0.9.25
0.9.26
0.9.27
0.9.28
0.9.29
0.9.3
0.9.30
0.9.31
0.9.32
0.9.33
0.9.34
0.9.35
0.9.36
0.9.37
0.9.38
0.9.39
0.9.4
0.9.40
0.9.41
0.9.42
0.9.43
0.9.44
0.9.45
0.9.46
0.9.47
0.9.48
0.9.49
0.9.5
0.9.50
0.9.51
0.9.52
0.9.53
0.9.54
0.9.55
0.9.56
0.9.57
0.9.58
0.9.59
0.9.6
0.9.60
0.9.61
0.9.62
0.9.63
0.9.64
0.9.65
0.9.66
0.9.67
0.9.68
0.9.69
0.9.7
0.9.8
0.9.9
Fixed in
0.9.70
References Updated Oct 19, 2026 · Source: OSV.dev | ||
0.9.61
patch
1 CVE
GHSA-pcc4-rvhr-2pr8
Oct 19, 2026
Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo
Medium
Local
Low
None
SummaryThe Fortran extractor's C-preprocessor step ( This is the exact "corpus-side file-exfiltration vector" the F-007 comment says it is defending against; the mitigation is bypassable. SeverityHigh. Arbitrary local-file read on the host, triggered by graphify's core action (indexing an untrusted folder — "turn any folder of code ... into a queryable knowledge graph"), defeating a documented security control. It runs on the default, offline, no-API-key AST path ( Where
Reached from Why the mitigation does not work
Proof of concept (verified)Reproduced against the shipped code with the exact command Secret on disk ( (a) Absolute include — (b) Relative traversal — Both produce preprocessed output containing the full secret file contents ( Surfacing into the graph —
Fidelity note: Fortran is case-insensitive, so captured identifiers are lower-cased. Case-insensitive secrets (file paths, hostnames, usernames, hex tokens, connection-string fragments, and the mere existence/partial content of a readable file) leak cleanly; high-entropy case-sensitive blobs (base64/JWT) are partially corrupted by the lower-casing but still confirm readability and structure. Single-token-per-line secret files (API-key files, single-line credential/token files) leak that token in full (lower-cased). Requires Suggested fixMirror the containment approach already used elsewhere in the codebase (
A blunter but safe alternative is to strip all Detected byAeon vuln-scanner. Semgrep flagged the Fortran subprocess path; manual review of the F-007 mitigation plus an empirical Affected versions
0.7.10
0.7.11
0.7.13
0.7.14
0.7.15
0.7.16
0.7.17
0.7.18
0.7.19
0.7.2
0.7.3
0.7.4
+ 124 more Show less
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.1
0.8.10
0.8.11
0.8.13
0.8.14
0.8.15
0.8.16
0.8.17
0.8.18
0.8.19
0.8.2
0.8.20
0.8.21
0.8.22
0.8.24
0.8.25
0.8.26
0.8.27
0.8.28
0.8.29
0.8.3
0.8.30
0.8.31
0.8.32
0.8.33
0.8.34
0.8.35
0.8.36
0.8.37
0.8.38
0.8.39
0.8.4
0.8.40
0.8.41
0.8.42
0.8.43
0.8.44
0.8.45
0.8.46
0.8.47
0.8.48
0.8.49
0.8.5
0.8.50
0.8.51
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.11
0.9.12
0.9.13
0.9.14
0.9.15
0.9.16
0.9.17
0.9.18
0.9.19
0.9.2
0.9.20
0.9.21
0.9.22
0.9.23
0.9.24
0.9.25
0.9.26
0.9.27
0.9.28
0.9.29
0.9.3
0.9.30
0.9.31
0.9.32
0.9.33
0.9.34
0.9.35
0.9.36
0.9.37
0.9.38
0.9.39
0.9.4
0.9.40
0.9.41
0.9.42
0.9.43
0.9.44
0.9.45
0.9.46
0.9.47
0.9.48
0.9.49
0.9.5
0.9.50
0.9.51
0.9.52
0.9.53
0.9.54
0.9.55
0.9.56
0.9.57
0.9.58
0.9.59
0.9.6
0.9.60
0.9.61
0.9.62
0.9.63
0.9.64
0.9.65
0.9.66
0.9.67
0.9.68
0.9.69
0.9.7
0.9.8
0.9.9
Fixed in
0.9.70
References Updated Oct 19, 2026 · Source: OSV.dev | ||
0.9.60
patch
1 CVE
GHSA-pcc4-rvhr-2pr8
Oct 19, 2026
Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo
Medium
Local
Low
None
SummaryThe Fortran extractor's C-preprocessor step ( This is the exact "corpus-side file-exfiltration vector" the F-007 comment says it is defending against; the mitigation is bypassable. SeverityHigh. Arbitrary local-file read on the host, triggered by graphify's core action (indexing an untrusted folder — "turn any folder of code ... into a queryable knowledge graph"), defeating a documented security control. It runs on the default, offline, no-API-key AST path ( Where
Reached from Why the mitigation does not work
Proof of concept (verified)Reproduced against the shipped code with the exact command Secret on disk ( (a) Absolute include — (b) Relative traversal — Both produce preprocessed output containing the full secret file contents ( Surfacing into the graph —
Fidelity note: Fortran is case-insensitive, so captured identifiers are lower-cased. Case-insensitive secrets (file paths, hostnames, usernames, hex tokens, connection-string fragments, and the mere existence/partial content of a readable file) leak cleanly; high-entropy case-sensitive blobs (base64/JWT) are partially corrupted by the lower-casing but still confirm readability and structure. Single-token-per-line secret files (API-key files, single-line credential/token files) leak that token in full (lower-cased). Requires Suggested fixMirror the containment approach already used elsewhere in the codebase (
A blunter but safe alternative is to strip all Detected byAeon vuln-scanner. Semgrep flagged the Fortran subprocess path; manual review of the F-007 mitigation plus an empirical Affected versions
0.7.10
0.7.11
0.7.13
0.7.14
0.7.15
0.7.16
0.7.17
0.7.18
0.7.19
0.7.2
0.7.3
0.7.4
+ 124 more Show less
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.1
0.8.10
0.8.11
0.8.13
0.8.14
0.8.15
0.8.16
0.8.17
0.8.18
0.8.19
0.8.2
0.8.20
0.8.21
0.8.22
0.8.24
0.8.25
0.8.26
0.8.27
0.8.28
0.8.29
0.8.3
0.8.30
0.8.31
0.8.32
0.8.33
0.8.34
0.8.35
0.8.36
0.8.37
0.8.38
0.8.39
0.8.4
0.8.40
0.8.41
0.8.42
0.8.43
0.8.44
0.8.45
0.8.46
0.8.47
0.8.48
0.8.49
0.8.5
0.8.50
0.8.51
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.11
0.9.12
0.9.13
0.9.14
0.9.15
0.9.16
0.9.17
0.9.18
0.9.19
0.9.2
0.9.20
0.9.21
0.9.22
0.9.23
0.9.24
0.9.25
0.9.26
0.9.27
0.9.28
0.9.29
0.9.3
0.9.30
0.9.31
0.9.32
0.9.33
0.9.34
0.9.35
0.9.36
0.9.37
0.9.38
0.9.39
0.9.4
0.9.40
0.9.41
0.9.42
0.9.43
0.9.44
0.9.45
0.9.46
0.9.47
0.9.48
0.9.49
0.9.5
0.9.50
0.9.51
0.9.52
0.9.53
0.9.54
0.9.55
0.9.56
0.9.57
0.9.58
0.9.59
0.9.6
0.9.60
0.9.61
0.9.62
0.9.63
0.9.64
0.9.65
0.9.66
0.9.67
0.9.68
0.9.69
0.9.7
0.9.8
0.9.9
Fixed in
0.9.70
References Updated Oct 19, 2026 · Source: OSV.dev | ||
0.9.59
patch
1 CVE
GHSA-pcc4-rvhr-2pr8
Oct 19, 2026
Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo
Medium
Local
Low
None
SummaryThe Fortran extractor's C-preprocessor step ( This is the exact "corpus-side file-exfiltration vector" the F-007 comment says it is defending against; the mitigation is bypassable. SeverityHigh. Arbitrary local-file read on the host, triggered by graphify's core action (indexing an untrusted folder — "turn any folder of code ... into a queryable knowledge graph"), defeating a documented security control. It runs on the default, offline, no-API-key AST path ( Where
Reached from Why the mitigation does not work
Proof of concept (verified)Reproduced against the shipped code with the exact command Secret on disk ( (a) Absolute include — (b) Relative traversal — Both produce preprocessed output containing the full secret file contents ( Surfacing into the graph —
Fidelity note: Fortran is case-insensitive, so captured identifiers are lower-cased. Case-insensitive secrets (file paths, hostnames, usernames, hex tokens, connection-string fragments, and the mere existence/partial content of a readable file) leak cleanly; high-entropy case-sensitive blobs (base64/JWT) are partially corrupted by the lower-casing but still confirm readability and structure. Single-token-per-line secret files (API-key files, single-line credential/token files) leak that token in full (lower-cased). Requires Suggested fixMirror the containment approach already used elsewhere in the codebase (
A blunter but safe alternative is to strip all Detected byAeon vuln-scanner. Semgrep flagged the Fortran subprocess path; manual review of the F-007 mitigation plus an empirical Affected versions
0.7.10
0.7.11
0.7.13
0.7.14
0.7.15
0.7.16
0.7.17
0.7.18
0.7.19
0.7.2
0.7.3
0.7.4
+ 124 more Show less
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.1
0.8.10
0.8.11
0.8.13
0.8.14
0.8.15
0.8.16
0.8.17
0.8.18
0.8.19
0.8.2
0.8.20
0.8.21
0.8.22
0.8.24
0.8.25
0.8.26
0.8.27
0.8.28
0.8.29
0.8.3
0.8.30
0.8.31
0.8.32
0.8.33
0.8.34
0.8.35
0.8.36
0.8.37
0.8.38
0.8.39
0.8.4
0.8.40
0.8.41
0.8.42
0.8.43
0.8.44
0.8.45
0.8.46
0.8.47
0.8.48
0.8.49
0.8.5
0.8.50
0.8.51
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.11
0.9.12
0.9.13
0.9.14
0.9.15
0.9.16
0.9.17
0.9.18
0.9.19
0.9.2
0.9.20
0.9.21
0.9.22
0.9.23
0.9.24
0.9.25
0.9.26
0.9.27
0.9.28
0.9.29
0.9.3
0.9.30
0.9.31
0.9.32
0.9.33
0.9.34
0.9.35
0.9.36
0.9.37
0.9.38
0.9.39
0.9.4
0.9.40
0.9.41
0.9.42
0.9.43
0.9.44
0.9.45
0.9.46
0.9.47
0.9.48
0.9.49
0.9.5
0.9.50
0.9.51
0.9.52
0.9.53
0.9.54
0.9.55
0.9.56
0.9.57
0.9.58
0.9.59
0.9.6
0.9.60
0.9.61
0.9.62
0.9.63
0.9.64
0.9.65
0.9.66
0.9.67
0.9.68
0.9.69
0.9.7
0.9.8
0.9.9
Fixed in
0.9.70
References Updated Oct 19, 2026 · Source: OSV.dev | ||
0.9.58
patch
1 CVE
GHSA-pcc4-rvhr-2pr8
Oct 19, 2026
Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo
Medium
Local
Low
None
SummaryThe Fortran extractor's C-preprocessor step ( This is the exact "corpus-side file-exfiltration vector" the F-007 comment says it is defending against; the mitigation is bypassable. SeverityHigh. Arbitrary local-file read on the host, triggered by graphify's core action (indexing an untrusted folder — "turn any folder of code ... into a queryable knowledge graph"), defeating a documented security control. It runs on the default, offline, no-API-key AST path ( Where
Reached from Why the mitigation does not work
Proof of concept (verified)Reproduced against the shipped code with the exact command Secret on disk ( (a) Absolute include — (b) Relative traversal — Both produce preprocessed output containing the full secret file contents ( Surfacing into the graph —
Fidelity note: Fortran is case-insensitive, so captured identifiers are lower-cased. Case-insensitive secrets (file paths, hostnames, usernames, hex tokens, connection-string fragments, and the mere existence/partial content of a readable file) leak cleanly; high-entropy case-sensitive blobs (base64/JWT) are partially corrupted by the lower-casing but still confirm readability and structure. Single-token-per-line secret files (API-key files, single-line credential/token files) leak that token in full (lower-cased). Requires Suggested fixMirror the containment approach already used elsewhere in the codebase (
A blunter but safe alternative is to strip all Detected byAeon vuln-scanner. Semgrep flagged the Fortran subprocess path; manual review of the F-007 mitigation plus an empirical Affected versions
0.7.10
0.7.11
0.7.13
0.7.14
0.7.15
0.7.16
0.7.17
0.7.18
0.7.19
0.7.2
0.7.3
0.7.4
+ 124 more Show less
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.1
0.8.10
0.8.11
0.8.13
0.8.14
0.8.15
0.8.16
0.8.17
0.8.18
0.8.19
0.8.2
0.8.20
0.8.21
0.8.22
0.8.24
0.8.25
0.8.26
0.8.27
0.8.28
0.8.29
0.8.3
0.8.30
0.8.31
0.8.32
0.8.33
0.8.34
0.8.35
0.8.36
0.8.37
0.8.38
0.8.39
0.8.4
0.8.40
0.8.41
0.8.42
0.8.43
0.8.44
0.8.45
0.8.46
0.8.47
0.8.48
0.8.49
0.8.5
0.8.50
0.8.51
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.11
0.9.12
0.9.13
0.9.14
0.9.15
0.9.16
0.9.17
0.9.18
0.9.19
0.9.2
0.9.20
0.9.21
0.9.22
0.9.23
0.9.24
0.9.25
0.9.26
0.9.27
0.9.28
0.9.29
0.9.3
0.9.30
0.9.31
0.9.32
0.9.33
0.9.34
0.9.35
0.9.36
0.9.37
0.9.38
0.9.39
0.9.4
0.9.40
0.9.41
0.9.42
0.9.43
0.9.44
0.9.45
0.9.46
0.9.47
0.9.48
0.9.49
0.9.5
0.9.50
0.9.51
0.9.52
0.9.53
0.9.54
0.9.55
0.9.56
0.9.57
0.9.58
0.9.59
0.9.6
0.9.60
0.9.61
0.9.62
0.9.63
0.9.64
0.9.65
0.9.66
0.9.67
0.9.68
0.9.69
0.9.7
0.9.8
0.9.9
Fixed in
0.9.70
References Updated Oct 19, 2026 · Source: OSV.dev | ||
0.9.57
patch
1 CVE
GHSA-pcc4-rvhr-2pr8
Oct 19, 2026
Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo
Medium
Local
Low
None
SummaryThe Fortran extractor's C-preprocessor step ( This is the exact "corpus-side file-exfiltration vector" the F-007 comment says it is defending against; the mitigation is bypassable. SeverityHigh. Arbitrary local-file read on the host, triggered by graphify's core action (indexing an untrusted folder — "turn any folder of code ... into a queryable knowledge graph"), defeating a documented security control. It runs on the default, offline, no-API-key AST path ( Where
Reached from Why the mitigation does not work
Proof of concept (verified)Reproduced against the shipped code with the exact command Secret on disk ( (a) Absolute include — (b) Relative traversal — Both produce preprocessed output containing the full secret file contents ( Surfacing into the graph —
Fidelity note: Fortran is case-insensitive, so captured identifiers are lower-cased. Case-insensitive secrets (file paths, hostnames, usernames, hex tokens, connection-string fragments, and the mere existence/partial content of a readable file) leak cleanly; high-entropy case-sensitive blobs (base64/JWT) are partially corrupted by the lower-casing but still confirm readability and structure. Single-token-per-line secret files (API-key files, single-line credential/token files) leak that token in full (lower-cased). Requires Suggested fixMirror the containment approach already used elsewhere in the codebase (
A blunter but safe alternative is to strip all Detected byAeon vuln-scanner. Semgrep flagged the Fortran subprocess path; manual review of the F-007 mitigation plus an empirical Affected versions
0.7.10
0.7.11
0.7.13
0.7.14
0.7.15
0.7.16
0.7.17
0.7.18
0.7.19
0.7.2
0.7.3
0.7.4
+ 124 more Show less
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.1
0.8.10
0.8.11
0.8.13
0.8.14
0.8.15
0.8.16
0.8.17
0.8.18
0.8.19
0.8.2
0.8.20
0.8.21
0.8.22
0.8.24
0.8.25
0.8.26
0.8.27
0.8.28
0.8.29
0.8.3
0.8.30
0.8.31
0.8.32
0.8.33
0.8.34
0.8.35
0.8.36
0.8.37
0.8.38
0.8.39
0.8.4
0.8.40
0.8.41
0.8.42
0.8.43
0.8.44
0.8.45
0.8.46
0.8.47
0.8.48
0.8.49
0.8.5
0.8.50
0.8.51
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.11
0.9.12
0.9.13
0.9.14
0.9.15
0.9.16
0.9.17
0.9.18
0.9.19
0.9.2
0.9.20
0.9.21
0.9.22
0.9.23
0.9.24
0.9.25
0.9.26
0.9.27
0.9.28
0.9.29
0.9.3
0.9.30
0.9.31
0.9.32
0.9.33
0.9.34
0.9.35
0.9.36
0.9.37
0.9.38
0.9.39
0.9.4
0.9.40
0.9.41
0.9.42
0.9.43
0.9.44
0.9.45
0.9.46
0.9.47
0.9.48
0.9.49
0.9.5
0.9.50
0.9.51
0.9.52
0.9.53
0.9.54
0.9.55
0.9.56
0.9.57
0.9.58
0.9.59
0.9.6
0.9.60
0.9.61
0.9.62
0.9.63
0.9.64
0.9.65
0.9.66
0.9.67
0.9.68
0.9.69
0.9.7
0.9.8
0.9.9
Fixed in
0.9.70
References Updated Oct 19, 2026 · Source: OSV.dev | ||
0.9.56
patch
1 CVE
GHSA-pcc4-rvhr-2pr8
Oct 19, 2026
Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo
Medium
Local
Low
None
SummaryThe Fortran extractor's C-preprocessor step ( This is the exact "corpus-side file-exfiltration vector" the F-007 comment says it is defending against; the mitigation is bypassable. SeverityHigh. Arbitrary local-file read on the host, triggered by graphify's core action (indexing an untrusted folder — "turn any folder of code ... into a queryable knowledge graph"), defeating a documented security control. It runs on the default, offline, no-API-key AST path ( Where
Reached from Why the mitigation does not work
Proof of concept (verified)Reproduced against the shipped code with the exact command Secret on disk ( (a) Absolute include — (b) Relative traversal — Both produce preprocessed output containing the full secret file contents ( Surfacing into the graph —
Fidelity note: Fortran is case-insensitive, so captured identifiers are lower-cased. Case-insensitive secrets (file paths, hostnames, usernames, hex tokens, connection-string fragments, and the mere existence/partial content of a readable file) leak cleanly; high-entropy case-sensitive blobs (base64/JWT) are partially corrupted by the lower-casing but still confirm readability and structure. Single-token-per-line secret files (API-key files, single-line credential/token files) leak that token in full (lower-cased). Requires Suggested fixMirror the containment approach already used elsewhere in the codebase (
A blunter but safe alternative is to strip all Detected byAeon vuln-scanner. Semgrep flagged the Fortran subprocess path; manual review of the F-007 mitigation plus an empirical Affected versions
0.7.10
0.7.11
0.7.13
0.7.14
0.7.15
0.7.16
0.7.17
0.7.18
0.7.19
0.7.2
0.7.3
0.7.4
+ 124 more Show less
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.1
0.8.10
0.8.11
0.8.13
0.8.14
0.8.15
0.8.16
0.8.17
0.8.18
0.8.19
0.8.2
0.8.20
0.8.21
0.8.22
0.8.24
0.8.25
0.8.26
0.8.27
0.8.28
0.8.29
0.8.3
0.8.30
0.8.31
0.8.32
0.8.33
0.8.34
0.8.35
0.8.36
0.8.37
0.8.38
0.8.39
0.8.4
0.8.40
0.8.41
0.8.42
0.8.43
0.8.44
0.8.45
0.8.46
0.8.47
0.8.48
0.8.49
0.8.5
0.8.50
0.8.51
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.11
0.9.12
0.9.13
0.9.14
0.9.15
0.9.16
0.9.17
0.9.18
0.9.19
0.9.2
0.9.20
0.9.21
0.9.22
0.9.23
0.9.24
0.9.25
0.9.26
0.9.27
0.9.28
0.9.29
0.9.3
0.9.30
0.9.31
0.9.32
0.9.33
0.9.34
0.9.35
0.9.36
0.9.37
0.9.38
0.9.39
0.9.4
0.9.40
0.9.41
0.9.42
0.9.43
0.9.44
0.9.45
0.9.46
0.9.47
0.9.48
0.9.49
0.9.5
0.9.50
0.9.51
0.9.52
0.9.53
0.9.54
0.9.55
0.9.56
0.9.57
0.9.58
0.9.59
0.9.6
0.9.60
0.9.61
0.9.62
0.9.63
0.9.64
0.9.65
0.9.66
0.9.67
0.9.68
0.9.69
0.9.7
0.9.8
0.9.9
Fixed in
0.9.70
References Updated Oct 19, 2026 · Source: OSV.dev | ||
0.9.55
patch
1 CVE
GHSA-pcc4-rvhr-2pr8
Oct 19, 2026
Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo
Medium
Local
Low
None
SummaryThe Fortran extractor's C-preprocessor step ( This is the exact "corpus-side file-exfiltration vector" the F-007 comment says it is defending against; the mitigation is bypassable. SeverityHigh. Arbitrary local-file read on the host, triggered by graphify's core action (indexing an untrusted folder — "turn any folder of code ... into a queryable knowledge graph"), defeating a documented security control. It runs on the default, offline, no-API-key AST path ( Where
Reached from Why the mitigation does not work
Proof of concept (verified)Reproduced against the shipped code with the exact command Secret on disk ( (a) Absolute include — (b) Relative traversal — Both produce preprocessed output containing the full secret file contents ( Surfacing into the graph —
Fidelity note: Fortran is case-insensitive, so captured identifiers are lower-cased. Case-insensitive secrets (file paths, hostnames, usernames, hex tokens, connection-string fragments, and the mere existence/partial content of a readable file) leak cleanly; high-entropy case-sensitive blobs (base64/JWT) are partially corrupted by the lower-casing but still confirm readability and structure. Single-token-per-line secret files (API-key files, single-line credential/token files) leak that token in full (lower-cased). Requires Suggested fixMirror the containment approach already used elsewhere in the codebase (
A blunter but safe alternative is to strip all Detected byAeon vuln-scanner. Semgrep flagged the Fortran subprocess path; manual review of the F-007 mitigation plus an empirical Affected versions
0.7.10
0.7.11
0.7.13
0.7.14
0.7.15
0.7.16
0.7.17
0.7.18
0.7.19
0.7.2
0.7.3
0.7.4
+ 124 more Show less
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.1
0.8.10
0.8.11
0.8.13
0.8.14
0.8.15
0.8.16
0.8.17
0.8.18
0.8.19
0.8.2
0.8.20
0.8.21
0.8.22
0.8.24
0.8.25
0.8.26
0.8.27
0.8.28
0.8.29
0.8.3
0.8.30
0.8.31
0.8.32
0.8.33
0.8.34
0.8.35
0.8.36
0.8.37
0.8.38
0.8.39
0.8.4
0.8.40
0.8.41
0.8.42
0.8.43
0.8.44
0.8.45
0.8.46
0.8.47
0.8.48
0.8.49
0.8.5
0.8.50
0.8.51
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.11
0.9.12
0.9.13
0.9.14
0.9.15
0.9.16
0.9.17
0.9.18
0.9.19
0.9.2
0.9.20
0.9.21
0.9.22
0.9.23
0.9.24
0.9.25
0.9.26
0.9.27
0.9.28
0.9.29
0.9.3
0.9.30
0.9.31
0.9.32
0.9.33
0.9.34
0.9.35
0.9.36
0.9.37
0.9.38
0.9.39
0.9.4
0.9.40
0.9.41
0.9.42
0.9.43
0.9.44
0.9.45
0.9.46
0.9.47
0.9.48
0.9.49
0.9.5
0.9.50
0.9.51
0.9.52
0.9.53
0.9.54
0.9.55
0.9.56
0.9.57
0.9.58
0.9.59
0.9.6
0.9.60
0.9.61
0.9.62
0.9.63
0.9.64
0.9.65
0.9.66
0.9.67
0.9.68
0.9.69
0.9.7
0.9.8
0.9.9
Fixed in
0.9.70
References Updated Oct 19, 2026 · Source: OSV.dev | ||
0.9.54
patch
1 CVE
GHSA-pcc4-rvhr-2pr8
Oct 19, 2026
Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo
Medium
Local
Low
None
SummaryThe Fortran extractor's C-preprocessor step ( This is the exact "corpus-side file-exfiltration vector" the F-007 comment says it is defending against; the mitigation is bypassable. SeverityHigh. Arbitrary local-file read on the host, triggered by graphify's core action (indexing an untrusted folder — "turn any folder of code ... into a queryable knowledge graph"), defeating a documented security control. It runs on the default, offline, no-API-key AST path ( Where
Reached from Why the mitigation does not work
Proof of concept (verified)Reproduced against the shipped code with the exact command Secret on disk ( (a) Absolute include — (b) Relative traversal — Both produce preprocessed output containing the full secret file contents ( Surfacing into the graph —
Fidelity note: Fortran is case-insensitive, so captured identifiers are lower-cased. Case-insensitive secrets (file paths, hostnames, usernames, hex tokens, connection-string fragments, and the mere existence/partial content of a readable file) leak cleanly; high-entropy case-sensitive blobs (base64/JWT) are partially corrupted by the lower-casing but still confirm readability and structure. Single-token-per-line secret files (API-key files, single-line credential/token files) leak that token in full (lower-cased). Requires Suggested fixMirror the containment approach already used elsewhere in the codebase (
A blunter but safe alternative is to strip all Detected byAeon vuln-scanner. Semgrep flagged the Fortran subprocess path; manual review of the F-007 mitigation plus an empirical Affected versions
0.7.10
0.7.11
0.7.13
0.7.14
0.7.15
0.7.16
0.7.17
0.7.18
0.7.19
0.7.2
0.7.3
0.7.4
+ 124 more Show less
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.1
0.8.10
0.8.11
0.8.13
0.8.14
0.8.15
0.8.16
0.8.17
0.8.18
0.8.19
0.8.2
0.8.20
0.8.21
0.8.22
0.8.24
0.8.25
0.8.26
0.8.27
0.8.28
0.8.29
0.8.3
0.8.30
0.8.31
0.8.32
0.8.33
0.8.34
0.8.35
0.8.36
0.8.37
0.8.38
0.8.39
0.8.4
0.8.40
0.8.41
0.8.42
0.8.43
0.8.44
0.8.45
0.8.46
0.8.47
0.8.48
0.8.49
0.8.5
0.8.50
0.8.51
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.11
0.9.12
0.9.13
0.9.14
0.9.15
0.9.16
0.9.17
0.9.18
0.9.19
0.9.2
0.9.20
0.9.21
0.9.22
0.9.23
0.9.24
0.9.25
0.9.26
0.9.27
0.9.28
0.9.29
0.9.3
0.9.30
0.9.31
0.9.32
0.9.33
0.9.34
0.9.35
0.9.36
0.9.37
0.9.38
0.9.39
0.9.4
0.9.40
0.9.41
0.9.42
0.9.43
0.9.44
0.9.45
0.9.46
0.9.47
0.9.48
0.9.49
0.9.5
0.9.50
0.9.51
0.9.52
0.9.53
0.9.54
0.9.55
0.9.56
0.9.57
0.9.58
0.9.59
0.9.6
0.9.60
0.9.61
0.9.62
0.9.63
0.9.64
0.9.65
0.9.66
0.9.67
0.9.68
0.9.69
0.9.7
0.9.8
0.9.9
Fixed in
0.9.70
References Updated Oct 19, 2026 · Source: OSV.dev | ||
0.9.53
patch
1 CVE
GHSA-pcc4-rvhr-2pr8
Oct 19, 2026
Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo
Medium
Local
Low
None
SummaryThe Fortran extractor's C-preprocessor step ( This is the exact "corpus-side file-exfiltration vector" the F-007 comment says it is defending against; the mitigation is bypassable. SeverityHigh. Arbitrary local-file read on the host, triggered by graphify's core action (indexing an untrusted folder — "turn any folder of code ... into a queryable knowledge graph"), defeating a documented security control. It runs on the default, offline, no-API-key AST path ( Where
Reached from Why the mitigation does not work
Proof of concept (verified)Reproduced against the shipped code with the exact command Secret on disk ( (a) Absolute include — (b) Relative traversal — Both produce preprocessed output containing the full secret file contents ( Surfacing into the graph —
Fidelity note: Fortran is case-insensitive, so captured identifiers are lower-cased. Case-insensitive secrets (file paths, hostnames, usernames, hex tokens, connection-string fragments, and the mere existence/partial content of a readable file) leak cleanly; high-entropy case-sensitive blobs (base64/JWT) are partially corrupted by the lower-casing but still confirm readability and structure. Single-token-per-line secret files (API-key files, single-line credential/token files) leak that token in full (lower-cased). Requires Suggested fixMirror the containment approach already used elsewhere in the codebase (
A blunter but safe alternative is to strip all Detected byAeon vuln-scanner. Semgrep flagged the Fortran subprocess path; manual review of the F-007 mitigation plus an empirical Affected versions
0.7.10
0.7.11
0.7.13
0.7.14
0.7.15
0.7.16
0.7.17
0.7.18
0.7.19
0.7.2
0.7.3
0.7.4
+ 124 more Show less
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.1
0.8.10
0.8.11
0.8.13
0.8.14
0.8.15
0.8.16
0.8.17
0.8.18
0.8.19
0.8.2
0.8.20
0.8.21
0.8.22
0.8.24
0.8.25
0.8.26
0.8.27
0.8.28
0.8.29
0.8.3
0.8.30
0.8.31
0.8.32
0.8.33
0.8.34
0.8.35
0.8.36
0.8.37
0.8.38
0.8.39
0.8.4
0.8.40
0.8.41
0.8.42
0.8.43
0.8.44
0.8.45
0.8.46
0.8.47
0.8.48
0.8.49
0.8.5
0.8.50
0.8.51
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.11
0.9.12
0.9.13
0.9.14
0.9.15
0.9.16
0.9.17
0.9.18
0.9.19
0.9.2
0.9.20
0.9.21
0.9.22
0.9.23
0.9.24
0.9.25
0.9.26
0.9.27
0.9.28
0.9.29
0.9.3
0.9.30
0.9.31
0.9.32
0.9.33
0.9.34
0.9.35
0.9.36
0.9.37
0.9.38
0.9.39
0.9.4
0.9.40
0.9.41
0.9.42
0.9.43
0.9.44
0.9.45
0.9.46
0.9.47
0.9.48
0.9.49
0.9.5
0.9.50
0.9.51
0.9.52
0.9.53
0.9.54
0.9.55
0.9.56
0.9.57
0.9.58
0.9.59
0.9.6
0.9.60
0.9.61
0.9.62
0.9.63
0.9.64
0.9.65
0.9.66
0.9.67
0.9.68
0.9.69
0.9.7
0.9.8
0.9.9
Fixed in
0.9.70
References Updated Oct 19, 2026 · Source: OSV.dev | ||
0.9.52
patch
1 CVE
GHSA-pcc4-rvhr-2pr8
Oct 19, 2026
Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo
Medium
Local
Low
None
SummaryThe Fortran extractor's C-preprocessor step ( This is the exact "corpus-side file-exfiltration vector" the F-007 comment says it is defending against; the mitigation is bypassable. SeverityHigh. Arbitrary local-file read on the host, triggered by graphify's core action (indexing an untrusted folder — "turn any folder of code ... into a queryable knowledge graph"), defeating a documented security control. It runs on the default, offline, no-API-key AST path ( Where
Reached from Why the mitigation does not work
Proof of concept (verified)Reproduced against the shipped code with the exact command Secret on disk ( (a) Absolute include — (b) Relative traversal — Both produce preprocessed output containing the full secret file contents ( Surfacing into the graph —
Fidelity note: Fortran is case-insensitive, so captured identifiers are lower-cased. Case-insensitive secrets (file paths, hostnames, usernames, hex tokens, connection-string fragments, and the mere existence/partial content of a readable file) leak cleanly; high-entropy case-sensitive blobs (base64/JWT) are partially corrupted by the lower-casing but still confirm readability and structure. Single-token-per-line secret files (API-key files, single-line credential/token files) leak that token in full (lower-cased). Requires Suggested fixMirror the containment approach already used elsewhere in the codebase (
A blunter but safe alternative is to strip all Detected byAeon vuln-scanner. Semgrep flagged the Fortran subprocess path; manual review of the F-007 mitigation plus an empirical Affected versions
0.7.10
0.7.11
0.7.13
0.7.14
0.7.15
0.7.16
0.7.17
0.7.18
0.7.19
0.7.2
0.7.3
0.7.4
+ 124 more Show less
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.1
0.8.10
0.8.11
0.8.13
0.8.14
0.8.15
0.8.16
0.8.17
0.8.18
0.8.19
0.8.2
0.8.20
0.8.21
0.8.22
0.8.24
0.8.25
0.8.26
0.8.27
0.8.28
0.8.29
0.8.3
0.8.30
0.8.31
0.8.32
0.8.33
0.8.34
0.8.35
0.8.36
0.8.37
0.8.38
0.8.39
0.8.4
0.8.40
0.8.41
0.8.42
0.8.43
0.8.44
0.8.45
0.8.46
0.8.47
0.8.48
0.8.49
0.8.5
0.8.50
0.8.51
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.11
0.9.12
0.9.13
0.9.14
0.9.15
0.9.16
0.9.17
0.9.18
0.9.19
0.9.2
0.9.20
0.9.21
0.9.22
0.9.23
0.9.24
0.9.25
0.9.26
0.9.27
0.9.28
0.9.29
0.9.3
0.9.30
0.9.31
0.9.32
0.9.33
0.9.34
0.9.35
0.9.36
0.9.37
0.9.38
0.9.39
0.9.4
0.9.40
0.9.41
0.9.42
0.9.43
0.9.44
0.9.45
0.9.46
0.9.47
0.9.48
0.9.49
0.9.5
0.9.50
0.9.51
0.9.52
0.9.53
0.9.54
0.9.55
0.9.56
0.9.57
0.9.58
0.9.59
0.9.6
0.9.60
0.9.61
0.9.62
0.9.63
0.9.64
0.9.65
0.9.66
0.9.67
0.9.68
0.9.69
0.9.7
0.9.8
0.9.9
Fixed in
0.9.70
References Updated Oct 19, 2026 · Source: OSV.dev | ||
0.9.51
patch
1 CVE
GHSA-pcc4-rvhr-2pr8
Oct 19, 2026
Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo
Medium
Local
Low
None
SummaryThe Fortran extractor's C-preprocessor step ( This is the exact "corpus-side file-exfiltration vector" the F-007 comment says it is defending against; the mitigation is bypassable. SeverityHigh. Arbitrary local-file read on the host, triggered by graphify's core action (indexing an untrusted folder — "turn any folder of code ... into a queryable knowledge graph"), defeating a documented security control. It runs on the default, offline, no-API-key AST path ( Where
Reached from Why the mitigation does not work
Proof of concept (verified)Reproduced against the shipped code with the exact command Secret on disk ( (a) Absolute include — (b) Relative traversal — Both produce preprocessed output containing the full secret file contents ( Surfacing into the graph —
Fidelity note: Fortran is case-insensitive, so captured identifiers are lower-cased. Case-insensitive secrets (file paths, hostnames, usernames, hex tokens, connection-string fragments, and the mere existence/partial content of a readable file) leak cleanly; high-entropy case-sensitive blobs (base64/JWT) are partially corrupted by the lower-casing but still confirm readability and structure. Single-token-per-line secret files (API-key files, single-line credential/token files) leak that token in full (lower-cased). Requires Suggested fixMirror the containment approach already used elsewhere in the codebase (
A blunter but safe alternative is to strip all Detected byAeon vuln-scanner. Semgrep flagged the Fortran subprocess path; manual review of the F-007 mitigation plus an empirical Affected versions
0.7.10
0.7.11
0.7.13
0.7.14
0.7.15
0.7.16
0.7.17
0.7.18
0.7.19
0.7.2
0.7.3
0.7.4
+ 124 more Show less
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.1
0.8.10
0.8.11
0.8.13
0.8.14
0.8.15
0.8.16
0.8.17
0.8.18
0.8.19
0.8.2
0.8.20
0.8.21
0.8.22
0.8.24
0.8.25
0.8.26
0.8.27
0.8.28
0.8.29
0.8.3
0.8.30
0.8.31
0.8.32
0.8.33
0.8.34
0.8.35
0.8.36
0.8.37
0.8.38
0.8.39
0.8.4
0.8.40
0.8.41
0.8.42
0.8.43
0.8.44
0.8.45
0.8.46
0.8.47
0.8.48
0.8.49
0.8.5
0.8.50
0.8.51
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.11
0.9.12
0.9.13
0.9.14
0.9.15
0.9.16
0.9.17
0.9.18
0.9.19
0.9.2
0.9.20
0.9.21
0.9.22
0.9.23
0.9.24
0.9.25
0.9.26
0.9.27
0.9.28
0.9.29
0.9.3
0.9.30
0.9.31
0.9.32
0.9.33
0.9.34
0.9.35
0.9.36
0.9.37
0.9.38
0.9.39
0.9.4
0.9.40
0.9.41
0.9.42
0.9.43
0.9.44
0.9.45
0.9.46
0.9.47
0.9.48
0.9.49
0.9.5
0.9.50
0.9.51
0.9.52
0.9.53
0.9.54
0.9.55
0.9.56
0.9.57
0.9.58
0.9.59
0.9.6
0.9.60
0.9.61
0.9.62
0.9.63
0.9.64
0.9.65
0.9.66
0.9.67
0.9.68
0.9.69
0.9.7
0.9.8
0.9.9
Fixed in
0.9.70
References Updated Oct 19, 2026 · Source: OSV.dev | ||
0.9.50
patch
1 CVE
GHSA-pcc4-rvhr-2pr8
Oct 19, 2026
Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo
Medium
Local
Low
None
SummaryThe Fortran extractor's C-preprocessor step ( This is the exact "corpus-side file-exfiltration vector" the F-007 comment says it is defending against; the mitigation is bypassable. SeverityHigh. Arbitrary local-file read on the host, triggered by graphify's core action (indexing an untrusted folder — "turn any folder of code ... into a queryable knowledge graph"), defeating a documented security control. It runs on the default, offline, no-API-key AST path ( Where
Reached from Why the mitigation does not work
Proof of concept (verified)Reproduced against the shipped code with the exact command Secret on disk ( (a) Absolute include — (b) Relative traversal — Both produce preprocessed output containing the full secret file contents ( Surfacing into the graph —
Fidelity note: Fortran is case-insensitive, so captured identifiers are lower-cased. Case-insensitive secrets (file paths, hostnames, usernames, hex tokens, connection-string fragments, and the mere existence/partial content of a readable file) leak cleanly; high-entropy case-sensitive blobs (base64/JWT) are partially corrupted by the lower-casing but still confirm readability and structure. Single-token-per-line secret files (API-key files, single-line credential/token files) leak that token in full (lower-cased). Requires Suggested fixMirror the containment approach already used elsewhere in the codebase (
A blunter but safe alternative is to strip all Detected byAeon vuln-scanner. Semgrep flagged the Fortran subprocess path; manual review of the F-007 mitigation plus an empirical Affected versions
0.7.10
0.7.11
0.7.13
0.7.14
0.7.15
0.7.16
0.7.17
0.7.18
0.7.19
0.7.2
0.7.3
0.7.4
+ 124 more Show less
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.1
0.8.10
0.8.11
0.8.13
0.8.14
0.8.15
0.8.16
0.8.17
0.8.18
0.8.19
0.8.2
0.8.20
0.8.21
0.8.22
0.8.24
0.8.25
0.8.26
0.8.27
0.8.28
0.8.29
0.8.3
0.8.30
0.8.31
0.8.32
0.8.33
0.8.34
0.8.35
0.8.36
0.8.37
0.8.38
0.8.39
0.8.4
0.8.40
0.8.41
0.8.42
0.8.43
0.8.44
0.8.45
0.8.46
0.8.47
0.8.48
0.8.49
0.8.5
0.8.50
0.8.51
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.11
0.9.12
0.9.13
0.9.14
0.9.15
0.9.16
0.9.17
0.9.18
0.9.19
0.9.2
0.9.20
0.9.21
0.9.22
0.9.23
0.9.24
0.9.25
0.9.26
0.9.27
0.9.28
0.9.29
0.9.3
0.9.30
0.9.31
0.9.32
0.9.33
0.9.34
0.9.35
0.9.36
0.9.37
0.9.38
0.9.39
0.9.4
0.9.40
0.9.41
0.9.42
0.9.43
0.9.44
0.9.45
0.9.46
0.9.47
0.9.48
0.9.49
0.9.5
0.9.50
0.9.51
0.9.52
0.9.53
0.9.54
0.9.55
0.9.56
0.9.57
0.9.58
0.9.59
0.9.6
0.9.60
0.9.61
0.9.62
0.9.63
0.9.64
0.9.65
0.9.66
0.9.67
0.9.68
0.9.69
0.9.7
0.9.8
0.9.9
Fixed in
0.9.70
References Updated Oct 19, 2026 · Source: OSV.dev |