CodeWhale AI tools can read your files

Published September 4, 2026 CVE-2026-75859

CodeWhale is a coding assistant that runs in a developer's terminal. A booby-trapped project file in a cloned repository can make it secretly read private files like SSH keys, then feed their contents into the AI conversation where the attacker can see them.

Severity
HighCVSS 3.1 · 7.5
Fix
Fixed in 0.8.41, 0.8.64Fix recorded on Sep 4, 2026
Affected versions
0.8.8 or newer, but before 0.8.41; 0.8.8 or newer, but before 0.8.41; 0.8.41 or newer, but before 0.8.64+1 more
Weakness
CWE-22Path Traversal
Exploit likelihood
0.41% in 30 daysEPSS, higher than 35% of known flaws
Affects
codewhale-tui+1 more

How it works

CodeWhale lets a repository include a config file that lists extra 'instructions' files to load into the AI's context, and it never checks whether those paths stay inside the project folder, so a path like a home-folder SSH key is read and pasted straight into the AI conversation.

What to do

Check the installed version with the package manager used to install it, for example npm list -g codewhale or cargo install --list, and compare it against 0.8.64.

Run this in the application environment you want to check:

npm list -g codewhale

Update to codewhale or codewhale-tui version 0.8.64 or later (deepseek-tui users should move to the renamed codewhale package at 0.8.41 or later first), and until then avoid opening untrusted cloned repositories in CodeWhale since the malicious config sits in the repo itself.

Technical details

Affected software: codewhale-tui, deepseek-tui

The project-config merge routine in crates/tui/src/main.rs copies an 'instructions' array from a repo-level.codewhale/config.toml (or legacy.deepseek/config.toml) straight into the live session config with no path validation. Those entries are later resolved by an expand_path helper that expands '~' and environment variables, so an attacker-controlled instructions list can point outside the workspace to files like ~/.ssh/id_rsa or ~/.aws/credentials. Their contents get read and injected into the AI system prompt, making them visible in the chat context and exfiltratable through it. Fixed in commit 43563356 for CodeWhale 0.8.64.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact None No data tampering
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Open in FIRST.org calculator

References

View Original Source