EUVD-2026-60970
GHSA-c6mw-8xh8-gpq6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, no auth required, passive user interaction needed; scope changes because stolen credentials impact systems beyond CodeWhale itself.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files such as SSH keys and credentials through the tool output returned to the model.
AnalysisAI
Argument injection in CodeWhale versions before 0.8.64 exposes arbitrary files on the host system by accepting unsanitized option-shaped values in the git_blame and git_show tools' rev parameter. An unauthenticated remote attacker who can influence the rev value - for example via a prompt injection payload in a malicious repository - can supply flags such as --contents=/home/user/.ssh/id_rsa, causing git to read and return the targeted file as tool output visible to the AI model. Vendor-released patch: 0.8.64 is available; no public exploit identified at time of analysis.
Technical ContextAI
CodeWhale is a Rust-based terminal UI application (crate path crates/tui/src/tools/git_history.rs) that wraps git operations as LLM-callable tools. The vulnerable components are GitBlameTool and GitShowTool, both of which accepted a caller-supplied rev string and interpolated it directly into git subprocess arguments without sanitization. CWE-88 (Improper Neutralization of Argument Delimiters in a Command) is the root cause: when user-controlled data is concatenated into a command argument list, a leading dash transforms the value into an option flag rather than a positional argument - in this case, git's --contents flag reads a file from the filesystem and returns its contents. The affected CPE is cpe:2.3:a:hmbown:codewhale:*:*:*:*:*:*:*:* covering all versions prior to 0.8.64. The fix (commit 9a34b5034d29f05d1f28fa61b04719ca6a741020) introduces a validate_git_rev function that rejects strings starting with a dash, as well as null bytes and ASCII control characters, before any git execution occurs.
RemediationAI
Upgrade CodeWhale to version 0.8.64 or later, which contains the input validation fix introduced in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020. The fix is documented in the vendor advisory at https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-c6mw-8xh8-gpq6 and the VulnCheck advisory at https://www.vulncheck.com/advisories/codewhale-before-argument-injection-via-git-blame. If an immediate upgrade is not possible, a specific compensating control is to restrict CodeWhale's use to trusted, internally controlled repositories only, preventing attacker-influenced content from reaching the git_blame or git_show tools. Additionally, running CodeWhale under a dedicated low-privilege user account with read-only access to only the necessary project directories limits the files an attacker can exfiltrate even if exploitation succeeds, though this does not prevent the vulnerability from being triggered.
Server-side request forgery in CodeWhale before 0.8.64 lets remote attackers reach internal-only IP addresses through th
Environment variable inheritance in CodeWhale's js_execution tool prior to version 0.8.64 allows crafted JavaScript payl
Unauthenticated file disclosure in CodeWhale before 0.8.64 allows arbitrary local file reads via the image_analyze tool'
Arbitrary file read in CodeWhale before version 0.8.64 allows an attacker to exfiltrate files from a developer's worksta
Argument injection in CodeWhale's git_show tool (versions 0.8.41-0.8.63) allows an attacker to cause arbitrary file writ
Remote code execution in CodeWhale (packages codewhale and codewhale-tui) versions 0.8.41 through 0.8.63 allows an attac
Shell command injection in CodeWhale before version 0.8.64 enables arbitrary code execution on a victim developer's mach
Prompt-injection-driven privilege escalation in CodeWhale 0.8.41-0.8.63 allows an attacker who can place malicious instr
Share
External POC / Exploit Code
Leaving vuln.today