EUVD-2026-60972Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network delivery via crafted repo, but user must open project (UI:R); no privileges on victim system needed; confidentiality only.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without user approval.
AnalysisAI
Unauthenticated file disclosure in CodeWhale before 0.8.64 allows arbitrary local file reads via the image_analyze tool's failure to resolve symbolic links before enforcing workspace boundaries. An attacker who can place a crafted symlink (named with an image extension) inside a victim's workspace - for example via a malicious git repository - can cause CodeWhale's vision endpoint to read and transmit the symlink target's bytes without user approval. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a malicious symbolic link - with an image-compatible file extension - exist within the CodeWhale workspace directory at the time image_analyze is invoked. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) assigns network vector and no user interaction, which warrants scrutiny: placing a symlink in the workspace requires delivering a crafted repository to the victim (e.g., via git clone), implying some user action. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker publishes a git repository containing a file named screenshot.png that is actually a symbolic link targeting /etc/passwd or a user's SSH private key. A developer clones the repository and opens it in a vulnerable version of CodeWhale; the AI assistant's image_analyze tool processes the apparent image file, follows the symlink, reads the sensitive target file's bytes, and transmits them to the vision endpoint - all without any explicit user approval prompt. … |
| Remediation | Upgrade to CodeWhale 0.8.64 or later, which incorporates the fix from commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e (https://github.com/Hmbown/CodeWhale/commit/26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all CodeWhale installations to identify instances running versions before 0.8.64 and instruct development teams to refrain from opening untrusted repositories until patching is complete. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-side request forgery in CodeWhale before 0.8.64 lets remote attackers reach internal-only IP addresses through th
Environment variable inheritance in CodeWhale's js_execution tool prior to version 0.8.64 allows crafted JavaScript payl
Arbitrary file read in CodeWhale before version 0.8.64 allows an attacker to exfiltrate files from a developer's worksta
Argument injection in CodeWhale's git_show tool (versions 0.8.41-0.8.63) allows an attacker to cause arbitrary file writ
Shell command injection in CodeWhale before version 0.8.64 enables arbitrary code execution on a victim developer's mach
Remote code execution in CodeWhale (packages codewhale and codewhale-tui) versions 0.8.41 through 0.8.63 allows an attac
Argument injection in CodeWhale versions before 0.8.64 exposes arbitrary files on the host system by accepting unsanitiz
Prompt-injection-driven privilege escalation in CodeWhale 0.8.41-0.8.63 allows an attacker who can place malicious instr
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today