EUVD-2026-60971
GHSA-7j5w-7r7x-9v27
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects mandatory prompt injection prerequisite; S:C because git writes escape application scope to user's SSH and shell config files; A:L for potential file corruption.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain an argument injection vulnerability in the git_show tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted as a git flag. Because the tool is registered as auto-approved and advertised as read-only, an attacker (via a malicious repository combined with prompt injection) can cause an unprompted arbitrary file write at the privilege of the invoking user, targeting sensitive files such as ~/.ssh/authorized_keys, ~/.bashrc, or ~/.gitconfig. Fixed in 0.8.64 by adding rev validation.
AnalysisAI
Argument injection in CodeWhale's git_show tool (versions 0.8.41-0.8.63) allows an attacker to cause arbitrary file writes at the invoking user's privilege level via a malicious repository combined with prompt injection. The model-supplied rev parameter is passed directly to git show argv without an --end-of-options sentinel, meaning a value beginning with --output= is interpreted by git as a file-write flag rather than a revision. Because the git_show tool is registered as auto-approved and advertised as read-only, exploitation bypasses the user confirmation prompt entirely, enabling silent overwrite of sensitive files such as ~/.ssh/authorized_keys or ~/.bashrc. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 0.8.64.
Technical ContextAI
CodeWhale (CPE: cpe:2.3:a:hmbown:codewhale) is an AI-assisted terminal UI coding tool that exposes git operations - including git show and git blame - as model-callable tools. These tools pass user-controllable (or in this case, model-controllable) parameters directly into subprocess argv arrays. The vulnerability (CWE-73: External Control of File Name or Path) arises because the rev parameter supplied by the language model is not validated before being appended to the git show argument vector. Git interprets any argument beginning with -- as a flag; specifically, --output=<path> causes git to write its output to an arbitrary filesystem path rather than stdout. The absence of an --end-of-options (--) sentinel before the rev argument means git cannot distinguish between an option and a legitimate revision. Critically, the tool is declared as auto-approved and read-only in the tool registry, so the MCP/tool-use layer does not prompt the user for confirmation, turning a seemingly benign read operation into a silent write primitive.
RemediationAI
Upgrade to CodeWhale version 0.8.64 or later, which introduces the validate_git_rev() function rejecting any revision string that is empty, begins with a hyphen (-), or contains null bytes or ASCII control characters. The patch is confirmed at commit 9a34b5034d29f05d1f28fa61b04719ca6a741020 and documented in the vendor advisory at GHSA-7j5w-7r7x-9v27. If an immediate upgrade is not possible, the most effective compensating control is to revoke the auto-approval designation for the git_show and git_blame tools in CodeWhale's tool configuration, forcing user confirmation before each invocation - this eliminates the silent-write risk at the cost of requiring manual approval for every git history lookup. Additionally, restricting CodeWhale use to trusted repositories (avoid cloning or opening repositories from untrusted sources) significantly reduces the prompt injection attack surface. Do not rely on operating-system file permissions alone as a compensating control, as the write target is constrained only by the invoking user's permissions.
Server-side request forgery in CodeWhale before 0.8.64 lets remote attackers reach internal-only IP addresses through th
Environment variable inheritance in CodeWhale's js_execution tool prior to version 0.8.64 allows crafted JavaScript payl
Unauthenticated file disclosure in CodeWhale before 0.8.64 allows arbitrary local file reads via the image_analyze tool'
Arbitrary file read in CodeWhale before version 0.8.64 allows an attacker to exfiltrate files from a developer's worksta
Remote code execution in CodeWhale (packages codewhale and codewhale-tui) versions 0.8.41 through 0.8.63 allows an attac
Shell command injection in CodeWhale before version 0.8.64 enables arbitrary code execution on a victim developer's mach
Argument injection in CodeWhale versions before 0.8.64 exposes arbitrary files on the host system by accepting unsanitiz
Prompt-injection-driven privilege escalation in CodeWhale 0.8.41-0.8.63 allows an attacker who can place malicious instr
Same weakness CWE-73 – External Control of File Name or Path
View allShare
External POC / Exploit Code
Leaving vuln.today