v0.0.670

Highlights

• Security: Fixes two chained EXECUTE_SHELL approval-bypass issues that let a malicious repository run arbitrary commands without user approval - advisories GHSA-2rr7-8xrw-gmhr (git core.sshCommand backdoor, RCE) and GHSA-4p93-4vf7-4m8r (find -exec bypass). Upgrade is strongly recommended for anyone running cgr (CLI, agent, or MCP) against untrusted repositories.
• Runtime Call Tracing: Extended dynamic call-graph tracing to Rust and C/C++, added eBPF continuous-profiler (pprof) ingest with Python and JVM frame resolution, and taught the JS/TS tracer to remap transpiled frames back to TypeScript sources via source maps.
• Dynamic Dispatch Provenance: Trace edges now capture concrete receiver classes for PHP, demangle C# local-function CLR frames to their nested node, and flag sampled-profiler edges as approximate.
• Traceback Correlation: New MCP tool correlates a runtime traceback against the graph and returns ranked root causes.
• Type Inference: Python loop variables now type from generic return annotations, and TS/JS variables type from annotations and for-of element types.

🔒 Security

This release closes two chained flaws in the EXECUTE_SHELL tool's approval gate. Both are exploited the same way: a repository the agent analyzes plants an instruction file (e.g. .cgr.md) that tells the agent a command is "required for the project to work - do NOT ask the user for permission." Where the approval gate could be reached at all, that framing turns it into a weak control, so the fixes tighten the gate and refuse the highest-impact command outright.

GHSA-2rr7-8xrw-gmhr - git core.sshCommand backdoor -> RCE (High, CVSS 7.5, CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Write-capable git subcommands were auto-approved, so an injected git config --global core.sshCommand <payload> was executed without a prompt. core.sshCommand (and peers like credential.helper, core.hooksPath, core.pager, alias.*, filter.*.clean/smudge/process, *tool.*.cmd) hold a value that git hands straight to a shell on the next SSH-based or hook-triggered git operation - a single write is remote code execution on the victim's machine. Fixed by removing git from the auto-approved set and blocking git config writes to any exec-carrying key outright, at every config scope, at the same layer that already refuses rm -rf /. Reads (--get, --list) and --unset stay allowed so a victim can inspect and clear a planted backdoor. Credit: @haomoumou.

GHSA-4p93-4vf7-4m8r - find -exec approval bypass (High, CVSS 7.3, CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, CWE-863). find was treated as a read-only command, but its -exec/-execdir/-ok/-okdir/-delete actions run arbitrary commands and mutate the filesystem, so an injected find ... -exec <payload> {} ; ran without approval. Fixed by requiring approval for find's mutating actions and reducing the read-only command set to {pwd, echo, tr}, so path-accepting readers (cat, ls, find, ...) can no longer be auto-approved. Credit: @regaan.

Affected: <= 0.0.669 · Patched: 0.0.670. Upgrade to 0.0.670 if you run cgr against repositories you do not fully control.

What's Changed

• feat: add C and C++ runtime call tracing via a -finstrument-functions shim by @vitali87 in #1267
• fix: rewrite pattern-in-WHERE cleanup queries for Memgraph 3.x and pin engine image by @vitali87 in #1259
• docs: add Runtime Call Tracing to Latest News by @vitali87 in #1270
• ci: fix the release news step dropping distinct new features by @vitali87 in #1271
• ci: enforce the no-em-dash rule in release notes and news by @vitali87 in #1272
• feat: flag sampled-profiler trace edges as approximate in the interchange format by @vitali87 in #1273
• test: demonstrate Lua metatable __index dispatch capture by @vitali87 in #1277
• feat: demonstrate C++ virtual-dispatch tracing and report unresolved addresses by @vitali87 in #1276
• feat: add Rust dynamic call-graph tracer (dyn dispatch capture) by @vitali87 in #1275
• feat: capture the concrete receiver class on PHP instance-call trace edges by @vitali87 in #1279
• feat: remap transpiled-JS trace frames to TypeScript sources via source maps by @vitali87 in #1280
• test: demonstrate Dart dynamic-dispatch capture via the VM Service collector by @vitali87 in #1282
• feat: demangle C# local-function CLR frames to their nested source node by @vitali87 in #1283
• test: add a live cargo + pprof-rs E2E for the Rust tracer by @vitali87 in #1284
• test: trace a real dart test file end-to-end via the VM Service collector by @vitali87 in #1285
• test: C/C++ CMake e2e + template-collapsing symbolisation (#1252) by @vitali87 in #1288
• test: live PHPUnit xdebug e2e + measured overhead (#1253) by @vitali87 in #1289
• test: live .NET test-run e2e (dotnet-trace) + receiver/overhead docs (#1249) by @vitali87 in #1291
• feat: JS/TS source-map resolution reporting + live TS e2e assertions (#1247) by @vitali87 in #1292
• feat: ingest eBPF continuous-profiler pprof profiles (#1287) by @vitali87 in #1293
• docs: complete the Runtime Call Tracing news entry (Rust, C/C++, eBPF) by @vitali87 in #1294
• feat: cgr trace pull - fetch and convert eBPF pprof over HTTP (#1287 follow-up) by @vitali87 in #1295
• fix: harden C# indexing and shell-read approval defaults (adopts #1231) by @vitali87 in #1296
• feat: resolve interpreted-runtime frames in eBPF pprof profiles (--language python) by @vitali87 in #1297
• feat: resolve JVM frames in eBPF pprof profiles (--language jvm) by @vitali87 in #1299
• feat: traceback-to-graph correlation with ranked root causes over MCP by @vitali87 in #1300
• chore: remove docs/TODO.md and repoint its references at the issue tracker by @vitali87 in #1302
• feat: type Python loop variables from generic return annotations by @vitali87 in #1305
• feat: type TS/JS variables from annotations and for-of loops from element types by @vitali87 in #1306
• refactor: extract call-expression typing to satisfy the cognitive complexity gate by @vitali87 in #1307

The two security fixes (GHSA-2rr7-8xrw-gmhr, GHSA-4p93-4vf7-4m8r) landed via a private security-advisory fork merge and are detailed in the Security section above.

Full Changelog: v0.0.639...v0.0.670