Which versions of CodeWhale are affected by CVE-2026-75859?

CodeWhale versions before 0.8.64 allow attackers to exfiltrate sensitive files from developer workstations through malicious repository configurations, exposing credentials, source code, and…. A patch is available.

Is there a public PoC exploit available for CVE-2026-75859?

Yes, a public proof-of-concept exploit is available for CVE-2026-75859. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-75859?

Within 24 hours, identify all CodeWhale installations and alert developers to verify any recently cloned repositories against CODEWHALE config file scanning. Within 7 days, upgrade all CodeWhale instances to version 0.8.64 or later and audit local repository caches for presence of malicious `.codewhale/config.toml` files in the past 90 days. Within 30 days, conduct forensic review of developer workstation logs for unauthorized file access patterns, rotate any credentials potentially stored in exfiltrated files, and implement mandatory code review for `.codewhale` configuration changes before merge.

CodeWhale CVE-2026-75859

Q: What is the CVSS score of CVE-2026-75859?

CVE-2026-75859 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-60966 HIGH

Path Traversal (CWE-22)

2026-08-18 VulnCheck

GHSA-62f5-cp2p-vq95

Path Traversal Codewhale Hmbown

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Victim must clone and open a malicious repo (UI:R); attack delivers via network but requires local tool execution; confidentiality-only impact with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 18, 2026 - 15:49 vuln.today

Analysis Generated

Aug 18, 2026 - 15:49 vuln.today

CVE Published

Aug 18, 2026 - 15:21 cve.org

HIGH 8.7

DescriptionCVE.org

CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and injected into the AI system prompt for exfiltration.

AnalysisAI

Arbitrary file read in CodeWhale before version 0.8.64 allows an attacker to exfiltrate files from a developer's workstation by embedding a malicious .codewhale/config.toml in a repository. The instructions array in project config accepted arbitrary filesystem paths without workspace boundary enforcement, causing the tool to silently read and inject targeted files into the AI system prompt. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack primitive is a well-understood path traversal and requires no technical sophistication beyond crafting a config file.

Technical ContextAI

CodeWhale (CPE: cpe:2.3:a:hmbown:codewhale:*:*:*:*:*:*:*:*) is a terminal-based AI coding assistant implemented in Rust that supports per-project configuration via a .codewhale/config.toml file at the repository root. The instructions field in that config accepts an array of file paths whose contents are prepended to the AI model's system prompt as context. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): path entries were resolved relative to the system without verifying they remained within the workspace directory tree, permitting traversal sequences or absolute paths targeting files elsewhere on the filesystem. The patch commit (43563356b98c6b993085554da82e77370160a31c) fully mitigates this by stripping project-scope instructions processing entirely - the key is now ignored with a warning, making the feature a no-op from untrusted project config. A parallel fix in the same commit also prevents project-scope allow_shell = true from escalating shell permissions, indicating a broader architectural decision to distrust project-controlled config for security-sensitive settings.

RemediationAI

Upgrade to CodeWhale version 0.8.64 or later, which removes project-scope instructions processing entirely via patch commit 43563356b98c6b993085554da82e77370160a31c. The fix is confirmed in the vendor advisory at https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-62f5-cp2p-vq95. If immediate upgrade is not possible, manually inspect .codewhale/config.toml before opening any cloned repository with CodeWhale, specifically auditing the instructions array for paths that reference locations outside the project root - any absolute path or relative path containing .. segments is a red flag. Additionally, restrict CodeWhale use to repositories from trusted, reviewed sources until patched. Note that the workaround relies on human review, which is error-prone and does not scale for teams cloning many repositories.