{"id":"ghsa-ghsa-pcc4-rvhr-2pr8","seq":2444,"kind":"advisory","title":"Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo","url":"https://github.com/advisories/GHSA-pcc4-rvhr-2pr8","permalink":"https://vulnpulse.app/items/ghsa-ghsa-pcc4-rvhr-2pr8","summary":"影響: pip:graphifyy >= 0.7.2, < 0.9.70 → 0.9.70\nSummary The Fortran extractor's C-preprocessor step (graphify/extractors/fortran.py, _cpp_preprocess) applies an incomplete #include hardening. The -nostdinc -I /dev/null flags it relies on (comment \"Security (F-007)\") do not stop a capital-F Fortran source file from including absolute paths (#include \"/etc/passwd\") or from path-traversing out of the corpus (#include \"../../../../home/victim/.ssh/id_rsa\"). cpp always searches the directory of the file being preprocessed for quoted includes and…","severity":"medium","techs":["python"],"cves":[],"tags":["GHSA-pcc4-rvhr-2pr8","graphifyy"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-19T16:51:36.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}