## Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo

- 種別: advisory
- 重大度: medium
- 関連技術: python
- 公開日時: 2026-10-19T16:51:36.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-pcc4-rvhr-2pr8)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-pcc4-rvhr-2pr8

影響: pip:graphifyy >= 0.7.2, < 0.9.70 → 0.9.70
Summary The Fortran extractor's C-preprocessor step (graphify/extractors/fortran.py, _cpp_preprocess) applies an incomplete #include hardening. The -nostdinc -I /dev/null flags it relies on (comment "Security (F-007)") do not stop a capital-F Fortran source file from including absolute paths (#include "/etc/passwd") or from path-traversing out of the corpus (#include "../../../../home/victim/.ssh/id_rsa"). cpp always searches the directory of the file being preprocessed for quoted includes and…