Skip to main content

CodeWhale CVE-2026-75914

| EUVDEUVD-2026-60972 HIGH
Path Traversal (CWE-22)
2026-08-18 VulnCheck
Path Traversal Codewhale
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

Network delivery via crafted repo, but user must open project (UI:R); no privileges on victim system needed; confidentiality only.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 18, 2026 - 15:51 vuln.today
Analysis Generated
Aug 18, 2026 - 15:51 vuln.today
CVE Published
Aug 18, 2026 - 15:22 cve.org
HIGH 8.7

DescriptionCVE.org

CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without user approval.

AnalysisAI

Unauthenticated file disclosure in CodeWhale before 0.8.64 allows arbitrary local file reads via the image_analyze tool's failure to resolve symbolic links before enforcing workspace boundaries. An attacker who can place a crafted symlink (named with an image extension) inside a victim's workspace - for example via a malicious git repository - can cause CodeWhale's vision endpoint to read and transmit the symlink target's bytes without user approval. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Publish repo with image-extension symlink
Delivery
Victim clones malicious repository
Exploit
Victim opens project in CodeWhale
Install
image_analyze tool invoked on symlink
C2
OS resolves symlink to target file
Execute
Target file bytes transmitted to vision endpoint
Impact
Sensitive file contents exfiltrated
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that a malicious symbolic link - with an image-compatible file extension - exist within the CodeWhale workspace directory at the time image_analyze is invoked. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) assigns network vector and no user interaction, which warrants scrutiny: placing a symlink in the workspace requires delivering a crafted repository to the victim (e.g., via git clone), implying some user action. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker publishes a git repository containing a file named screenshot.png that is actually a symbolic link targeting /etc/passwd or a user's SSH private key. A developer clones the repository and opens it in a vulnerable version of CodeWhale; the AI assistant's image_analyze tool processes the apparent image file, follows the symlink, reads the sensitive target file's bytes, and transmits them to the vision endpoint - all without any explicit user approval prompt. …
Remediation Upgrade to CodeWhale 0.8.64 or later, which incorporates the fix from commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e (https://github.com/Hmbown/CodeWhale/commit/26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, audit all CodeWhale installations to identify instances running versions before 0.8.64 and instruct development teams to refrain from opening untrusted repositories until patching is complete. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Codewhale

View all
CVE-2026-75856 CRITICAL
9.2 Aug 18

Server-side request forgery in CodeWhale before 0.8.64 lets remote attackers reach internal-only IP addresses through th
CVE-2026-75915 HIGH
8.7 Aug 18

Environment variable inheritance in CodeWhale's js_execution tool prior to version 0.8.64 allows crafted JavaScript payl
CVE-2026-75859 HIGH
8.7 Aug 18

Arbitrary file read in CodeWhale before version 0.8.64 allows an attacker to exfiltrate files from a developer's worksta
CVE-2026-75913 HIGH
8.5 Aug 18

Argument injection in CodeWhale's git_show tool (versions 0.8.41-0.8.63) allows an attacker to cause arbitrary file writ
CVE-2026-75911 HIGH
8.5 Aug 18

Shell command injection in CodeWhale before version 0.8.64 enables arbitrary code execution on a victim developer's mach
CVE-2026-75858 HIGH
8.5 Aug 18

Remote code execution in CodeWhale (packages codewhale and codewhale-tui) versions 0.8.41 through 0.8.63 allows an attac
CVE-2026-75912 HIGH
8.3 Aug 18

Argument injection in CodeWhale versions before 0.8.64 exposes arbitrary files on the host system by accepting unsanitiz
CVE-2026-75857 HIGH
7.3 Aug 18

Prompt-injection-driven privilege escalation in CodeWhale 0.8.41-0.8.63 allows an attacker who can place malicious instr

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2022-37042 CRITICAL POC
9.8

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8
CVE-2022-30333 HIGH POC
7.5

Share

CVE-2026-75914 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy