graphifyy@0.9.37

graphifyy is an AI coding assistant skill (Claude Code, CodeBuddy, Codex, OpenCode, Kilo Code, Cursor, Gemini CLI, Aider, OpenClaw, Factory Droid, Trae, Hermes, Kiro, Pi, Devin CLI, Google Antigravity) - turn any folder of code, docs, papers, images, or videos into a queryable knowledge graph

Affected versions of this package are vulnerable to External Control of File Name or Path via the _cpp_preprocess function in graphify/extractors/fortran.py when processing capital-F Fortran source files (.F, .F90, etc.). The function previously relied on -nostdinc -I /dev/null flags to block file reads during C preprocessing, but cpp always searches the source file's own directory for quoted includes and always honours absolute paths regardless of those flags. An attacker who supplies a malicious Fortran file containing #include "/etc/passwd" or #include "../../../secret" can cause arbitrary host files to be inlined into the generated graph.json, GRAPH_REPORT.md, and the LLM context.

Upgrade graphifyy to version 0.9.70 or higher.