Security advisories
These advisories document previously remediated vulnerabilities in codeindexer , consolidated for publication during an October 2026 retrospective review of its development history.
The review covered 6,787 commits and releases v0.2.0 through v0.12.0. It individually verified 43 security-related remediation and test commits, 41 of which added inline Rust tests.
Every issue listed here is fixed in a public release. Upgrade to CodeIndexer v0.12.0 or later, which includes the fixes for every advisory currently published in this collection.
Last updated: October 21, 2026 · NetTechnologys s.r.o.
Published advisories
-
CI-SA-2026-001 High FixedMissing Host-header validation allowed DNS rebinding
- Affected
- v0.2.0 – v0.11.0 v0.2.0 binaries report version 0.1.0
- First fixed version
- v0.12.0
- Published
-
CI-SA-2026-002 High FixedPath traversal in the source-lines endpoint allowed arbitrary file read
- Affected
- v0.4.0 – v0.10.0 · Path traversal (arbitrary file read) v0.9.0 – v0.10.0 · Missing per-key project check (read of another project’s source)
- First fixed version
- v0.11.0
- Published
-
CI-SA-2026-003 High FixedUnvalidated project identifiers could escape the index root
- Affected
- v0.2.0 – v0.11.0 · Directory removal through the MCP project-delete tool v0.3.0 – v0.11.0 · Directory removal through the HTTP projects API v0.9.0 – v0.11.0 · Index-metadata repair triggered by read requests v0.2.0 binaries report version 0.1.0
- First fixed version
- v0.12.0
- Published
-
CI-SA-2026-005 High FixedPer-key project authorization was not enforced across MCP tools
- Affected
- v0.2.0 – v0.6.0 · Code search, call-graph, audit and project-management tools v0.2.0 – v0.11.0 · Memory-card and solutions tools v0.7.0 – v0.11.0 · Reports, roadmap and card-chat tools (introduced in v0.7.0) v0.2.0 binaries report version 0.1.0
- Fully remediated in
- v0.12.0
- Published
-
CI-SA-2026-009 Medium FixedArchive member paths could escape the extraction directory
- Affected
- v0.2.0 – v0.6.0 v0.2.0 binaries report version 0.1.0
- First fixed version
- v0.7.0
- Published
Severity uses a four-level scale — Critical, High, Medium, Low — judged by attacker reach, the required preconditions (default or opt-in configuration, loopback or exposed bind) and the consequence. CVSS scores are not published. A CVE identifier is shown on an advisory only once one has been assigned.
Follow our responsible disclosure policy: open a private advisory on GitHub or email [email protected].