CVE-2026-45046: safedep Gryph sensitive information disclosure in local logs

Executive brief

Gryph is a tool used by AI coding agents to interact with files and systems. A vulnerability in its logging mechanism causes sensitive file contents to be stored in a local database even when filters are active. If an unauthorized person gains access to this local database, they could view sensitive information that was supposed to be protected or redacted.

Technical details

Gryph implements logging levels to control what content is stored in a local SQLite database. Due to a failure in the payload filter, sensitive 'file-write' content is retained in fields such as ContentPreview, OldString, or NewString at the default 'standard' and 'full' logging levels. This violates the intended sensitive file filter and log level contracts. An attacker with local access to the SQLite database can retrieve sensitive file content that was accessed or written by coding agents. The issue is fixed in version 0.7.0.

Affected products

• safedep gryph <= 0.6.0

Timeline

• 2026-05-11: advisory: GitHub Advisory published
• 2026-05-11: patched: Fixed in version 0.7.0

References

• https://api.github.com/users/dodge1218
• https://github.com/dodge1218
• https://api.github.com/users/dodge1218/gists%7B/gist_id%7D
• https://api.github.com/users/dodge1218/repos
• https://avatars.githubusercontent.com/u/235199066?v=4
• https://api.github.com/users/dodge1218/events%7B/privacy%7D