EUVD-2026-60970Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, no auth required, passive user interaction needed; scope changes because stolen credentials impact systems beyond CodeWhale itself.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files such as SSH keys and credentials through the tool output returned to the model.
AnalysisAI
Argument injection in CodeWhale versions before 0.8.64 exposes arbitrary files on the host system by accepting unsanitized option-shaped values in the git_blame and git_show tools' rev parameter. An unauthenticated remote attacker who can influence the rev value - for example via a prompt injection payload in a malicious repository - can supply flags such as --contents=/home/user/.ssh/id_rsa, causing git to read and return the targeted file as tool output visible to the AI model. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker control or influence the value of the rev parameter passed to CodeWhale's git_blame or git_show tools. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.3 with vector AV:N/AC:L/AT:N/PR:N/UI:P reflects the attack's low complexity and high confidentiality impact on both the vulnerable system (VC:H) and subsequent systems (SC:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker embeds a prompt injection payload in a README or source file within a public repository - for example, an instruction directing the AI model to call git_blame on a specific file with rev set to --contents=/home/user/.ssh/id_rsa. When a developer opens the repository in a vulnerable CodeWhale version, the model processes the content, calls GitBlameTool with the injected rev, and receives the SSH private key as tool output. … |
| Remediation | Upgrade CodeWhale to version 0.8.64 or later, which contains the input validation fix introduced in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all CodeWhale deployments and verify current versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-side request forgery in CodeWhale before 0.8.64 lets remote attackers reach internal-only IP addresses through th
Environment variable inheritance in CodeWhale's js_execution tool prior to version 0.8.64 allows crafted JavaScript payl
Unauthenticated file disclosure in CodeWhale before 0.8.64 allows arbitrary local file reads via the image_analyze tool'
Arbitrary file read in CodeWhale before version 0.8.64 allows an attacker to exfiltrate files from a developer's worksta
Argument injection in CodeWhale's git_show tool (versions 0.8.41-0.8.63) allows an attacker to cause arbitrary file writ
Shell command injection in CodeWhale before version 0.8.64 enables arbitrary code execution on a victim developer's mach
Remote code execution in CodeWhale (packages codewhale and codewhale-tui) versions 0.8.41 through 0.8.63 allows an attac
Prompt-injection-driven privilege escalation in CodeWhale 0.8.41-0.8.63 allows an attacker who can place malicious instr
Share
External POC / Exploit Code
Leaving vuln.today