EUVD-2026-60971Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects mandatory prompt injection prerequisite; S:C because git writes escape application scope to user's SSH and shell config files; A:L for potential file corruption.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain an argument injection vulnerability in the git_show tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted as a git flag. Because the tool is registered as auto-approved and advertised as read-only, an attacker (via a malicious repository combined with prompt injection) can cause an unprompted arbitrary file write at the privilege of the invoking user, targeting sensitive files such as ~/.ssh/authorized_keys, ~/.bashrc, or ~/.gitconfig. Fixed in 0.8.64 by adding rev validation.
AnalysisAI
Argument injection in CodeWhale's git_show tool (versions 0.8.41-0.8.63) allows an attacker to cause arbitrary file writes at the invoking user's privilege level via a malicious repository combined with prompt injection. The model-supplied rev parameter is passed directly to git show argv without an --end-of-options sentinel, meaning a value beginning with --output= is interpreted by git as a file-write flag rather than a revision. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concurrent conditions: (1) the victim must be running a vulnerable CodeWhale version (0.8.41 to 0.8.63) and must open or interact with a repository containing attacker-controlled content capable of triggering prompt injection - this is a non-default user action (opening an untrusted repo) but requires no special configuration; (2) the prompt injection payload must successfully cause the language model to invoke the git_show or git_blame tool with a rev value beginning with --, which depends on the model's instruction-following behavior and the sophistication of the injected content. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.5 (AV:N/AC:L/AT:N/PR:N/UI:P) reflects a credible but multi-stage attack: the victim must open a malicious repository, and prompt injection must succeed in coercing the model into calling git_show with a crafted rev value. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker publishes a malicious git repository containing prompt injection content embedded in repository metadata (e.g., a crafted COMMIT_EDITMSG, README, or git note) that instructs the CodeWhale model to call git_show with rev set to --output=/home/victim/.ssh/authorized_keys. When the victim opens or pulls the repository in an affected CodeWhale version, the model processes the injected instruction and invokes git_show with the crafted argument; because the tool is auto-approved, no confirmation dialog appears. … |
| Remediation | Upgrade to CodeWhale version 0.8.64 or later, which introduces the validate_git_rev() function rejecting any revision string that is empty, begins with a hyphen (-), or contains null bytes or ASCII control characters. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all systems running CodeWhale versions 0.8.41-0.8.63 and restrict access to untrusted repository sources where feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-side request forgery in CodeWhale before 0.8.64 lets remote attackers reach internal-only IP addresses through th
Environment variable inheritance in CodeWhale's js_execution tool prior to version 0.8.64 allows crafted JavaScript payl
Unauthenticated file disclosure in CodeWhale before 0.8.64 allows arbitrary local file reads via the image_analyze tool'
Arbitrary file read in CodeWhale before version 0.8.64 allows an attacker to exfiltrate files from a developer's worksta
Shell command injection in CodeWhale before version 0.8.64 enables arbitrary code execution on a victim developer's mach
Remote code execution in CodeWhale (packages codewhale and codewhale-tui) versions 0.8.41 through 0.8.63 allows an attac
Argument injection in CodeWhale versions before 0.8.64 exposes arbitrary files on the host system by accepting unsanitiz
Prompt-injection-driven privilege escalation in CodeWhale 0.8.41-0.8.63 allows an attacker who can place malicious instr
Same weakness CWE-73 – External Control of File Name or Path
View allShare
External POC / Exploit Code
Leaving vuln.today