Arbitrary File Read Vulnerability in Graphifyy Package: Incomplete C Preprocessor Hardening
Summary
GHSA-pcc4-rvhr-2pr8: The Fortran extractor's C-preprocessor step (graphify/extractors/fortran.py, _cpp_preprocess) applies an incomplete #include hardening. Affects graphifyy versions >= 0.7.2, < 0.9.70. Fixed in 0.9.70. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Graphifyy is an open-source tool designed to transform code repositories into queryable knowledge graphs. It utilizes various extractors to analyze source code files, including Fortran files. The package aims to enhance code understanding and facilitate knowledge sharing among developers. However, it has a critical vulnerability that allows arbitrary file reading from the host system when processing untrusted Fortran source files.
Vulnerability Detail
The vulnerability arises from the Fortran extractor's C-preprocessor step, which implements insufficient hardening against #include directives. The flags -nostdinc and -I /dev/null do not prevent absolute paths or path traversal from being included in the preprocessing step. This allows an attacker to include sensitive files from the host system, such as /etc/passwd or files outside the intended repository, leading to potential information exposure and security breaches. The vulnerability is classified under CWE-22 (path traversal) and CWE-73 (external control of file name/path), with a CVSS score of 6.8.
How To Fix
Latest published version: 0.9.93 as of 22 Oct 2026
pip install --upgrade "graphifyy==0.9.93"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.9.70
This is the first release that contains the fix.
pip install --upgrade "graphifyy==0.9.70"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually scan the source files for #include directives and remove any that are absolute or could lead to path traversal before processing them with Graphifyy. Alternatively, you can strip all #include lines before preprocessing to prevent any file reads, although this may affect the fidelity of cross-file includes.
Conclusion
The Graphifyy package contains a critical vulnerability that allows arbitrary file reading due to incomplete hardening of the C-preprocessor step. Users are advised to update to the latest version to mitigate this risk and implement additional safeguards as necessary.
See every vulnerability recorded for graphifyy →
FAQ
The vulnerability allows arbitrary file reading from the host system due to insufficient hardening against #include directives in Fortran source files.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
The consequences include unauthorized access to sensitive files on the host system, leading to information exposure and potential security breaches.
You can update the Graphifyy package by running the command: pip install --upgrade graphifyy to ensure you are using version 0.9.70 or later.
Yes, you can manually remove or neutralize any #include directives in your Fortran source files that are absolute or could lead to path traversal as a temporary measure.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
