CVE-2026-75912
Full vulnerability record from the local CVENow database.
Description
CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files such as SSH keys and credentials through the tool output returned to the model.
Severity
HIGH
CVSS score
8.3
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-08-18 16:18:23.220000
Last modified
2026-10-22 22:10:00.250000
View original CVE JSON
{
"id": "CVE-2026-75912",
"sourceIdentifier": "[email protected]",
"published": "2026-08-18T16:18:23.220",
"lastModified": "2026-10-22T22:10:00.250",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files such as SSH keys and credentials through the tool output returned to the model."
},
{
"lang": "es",
"value": "Las versiones de CodeWhale anteriores a la 0.8.64 contienen una vulnerabilidad de inyección de argumentos en la herramienta git_blame que permite a los atacantes leer archivos arbitrarios inyectando opciones de git en el parámetro rev no validado. Los atacantes pueden proporcionar valores de rev como --contents=/path/to/file para exfiltrar archivos sensibles como claves SSH y credenciales a través de la salida de la herramienta devuelta al modelo."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Hmbown",
"product": "CodeWhale",
"defaultStatus": "unaffected",
"packageURL": "pkg:cargo/deepseek-tui",
"versions": [
{
"version": "0.3.27",
"lessThan": "0.8.41",
"versionType": "semver",
"status": "affected"
},
{
"version": "0.8.41",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "Hmbown",
"product": "CodeWhale",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/deepseek-tui",
"versions": [
{
"version": "0.3.27",
"lessThan": "0.8.41",
"versionType": "semver",
"status": "affected"
},
{
"version": "0.8.41",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "Hmbown",
"product": "CodeWhale",
"defaultStatus": "unaffected",
"packageURL": "pkg:cargo/codewhale-tui",
"versions": [
{
"version": "0.8.41",
"lessThan": "0.8.64",
"versionType": "semver",
"status": "affected"
},
{
"version": "0.8.64",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "Hmbown",
"product": "CodeWhale",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/codewhale",
"versions": [
{
"version": "0.8.41",
"lessThan": "0.8.64",
"versionType": "semver",
"status": "affected"
},
{
"version": "0.8.64",
"versionType": "semver",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 4.0
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-19T14:38:17.279780Z",
"id": "CVE-2026-75912",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-88"
}
]
}
],
"references": [
{
"url": "https://github.com/Hmbown/CodeWhale/commit/9a34b5034d29f05d1f28fa61b04719ca6a741020",
"source": "[email protected]"
},
{
"url": "https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-c6mw-8xh8-gpq6",
"source": "[email protected]"
},
{
"url": "https://www.vulncheck.com/advisories/codewhale-before-argument-injection-via-git-blame",
"source": "[email protected]"
},
{
"url": "https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-c6mw-8xh8-gpq6",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}