T02 · Agent Memory Poisoning
Warning
- Location
- codegraph_assist.py:66
- Finding
- Untrusted CodeGraph Output Written to Persistent Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `codegraph_assist.py:66-87` **Vulnerability Type**: Persistent agent memory poisoning **Risk Level**: Medium ### Vulnerable Code ```python def cmd_inject(path=None): cwd = Path(path or os.getcwd()).resolve() out, err, rc = run_cg(["status"], cwd=str(cwd)) out2, err2, rc2 = run_cg(["files", "--max-depth", "2"], cwd=str(cwd)) summary = f"\n## CodeGraph: {cwd.name}\n" summary += f"_Auto-generated via codegraph-assistant_\n\n" summary += out + "\n### File Structure\n" + out2 memory_path = cwd / MEMORY_FILE existing = memory_path.read_text(encoding="utf-8", errors="replace") if memory_path.exists() else "" marker = "## CodeGraph:" if marker in existing: lines = existing.splitlines() new_lines, skip = [], False for line in lines: if line.startswith(marker): skip = True; continue if skip and line.startswith("## "): skip = False; new_lines.append(line); continue if not skip: new_lines.append(line) existing = "\n".join(new_lines).rstrip() + "\n" memory_path.write_text(existing.rstrip() + "\n" + summary, encoding="utf-8") print(f"Injected summary into {memory_path}") ``` ### Technical Analysis The `inject` command obtains project status and file-structure text from an external `codegraph` executable and writes that output directly into `MEMORY.md`. The project directory name is also embedded in the generated content. None of this generated content is validated, escaped, or explicitly marked as untrusted before being placed in a file intended for persistent Agent memory. This creates a trust-boundary violation: information originating from a project and an external executable is promoted into persistent Agent context. If an attacker can influence the generated output—for example, through crafted project metadata or filenames represented by CodeGraph—or if the locally installed CodeGraph executable ...[truncated 2186 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Store generated CodeGraph data in a dedicated cache or report file that is not automatically treated as Agent memory. 2. Require explicit user confirmation before creating or modifying `MEMORY.md`, and display the exact target path and generated content before writing. 3. Treat CodeGraph output and project-derived values as untrusted data. Place them inside clearly delimited data blocks and state that the enclosed text must not be interpreted as instructions. 4. Validate and normalize generated output before persistence. Reject or encode control characters, memory headings, instruction-like delimiters, and other syntax capable of escaping the intended data section. 5. Use unique start and end markers, such as `<!-- CODEGRAPH_START -->` and `<!-- CODEGRAPH_END -->`, and replace only content between the exact paired markers. 6. Preserve unrelated memory content and create a backup before modifying an existing file. Use an atomic write through a securely created temporary file followed by replacement. 7. Restrict the target path to an explicitly approved project root and verify that `MEMORY.md` is not a symbolic link before writing. 8. Check CodeGraph return codes and abort injection if either subprocess fails; do not persist partial, malformed, or unexpected output. 9. Pin and verify the expected CodeGraph installation or executable integrity to reduce the risk of compromised tool output entering persistent memory. ]]>