Version identification: Binaries of release v0.2.0 report version 0.1.0 (for example in --version output and in the MCP server information). Treat a build that reports 0.1.0 as affected; builds reporting 0.1.0 that predate release v0.2.0 were not assessed and must not be assumed unaffected.
Project names supplied in requests were used as directory names under the index root without validation. A name in the form of an absolute path, or one containing parent-directory components, could therefore refer to a directory outside the index root.
Deleting a project by such a name removed the referenced directory recursively, with the permissions of the account running CodeIndexer; the server’s own internal knowledge store could be deleted the same way. From v0.9.0, a read request naming such a directory could also trigger the automatic repair of index metadata in it — restoring a backup copy over, or renaming, a meta.json file outside the index root.
Index store and project management — project deletion over MCP and the HTTP API, and the index-metadata (meta.json) loader used when a project is looked up.
Source modules:
src/indexer/store/meta.rs, src/indexer/store/mod.rs, src/indexer/project_admin.rs, src/mcp/api/projects.rs
Upgrade to CodeIndexer v0.12.0 or later. No alternative workaround is documented.
First fixed version: v0.12.0. Recommended upgrade: v0.12.0 or later, which includes the fixes for every advisory currently published in this collection.
v0.12.0 validates every project name before any file-system use, refuses absolute and parent-relative names (including percent-encoded path segments), and treats deletion by path as a caller error.
First affected version: v0.2.0 (release-tag commit) — project deletion through the MCP project-delete tool.
v0.3.0 (release-tag commit) — project deletion becomes reachable through the HTTP projects API.
v0.9.0 (release-tag commit) — automatic index-metadata repair is added and can be triggered by read requests.
Fix committed (d5ee0d7672fa).
Follow-up fix committed (bafde11d3a64).
First fixed version: v0.12.0 (release-tag commit).
Advisory published.
Dates come from the project’s git history: fixes by their commit date, versions by the date of the commit their release tag points to — not necessarily the day a build became available for download.
d5ee0d7672fa
2026-09-26
Project names validated before any file-system use.
bafde11d3a64
2026-09-27
Remaining file-system sinks and percent-decoded path segments closed.
CodeIndexer is proprietary software. Commit references identify internal development history and correlate this advisory with our security-review evidence. Their publication does not make the proprietary source code public.
Questions about this advisory, or a new vulnerability to report: email [email protected] or open a private advisory on GitHub. See our security policy for the full disclosure process.
We use a couple of small first-party cookies to keep the site working and remember your theme preference. No tracking, no ads. Learn more.