CodeWhale bug can expose files

Published September 4, 2026 CVE-2026-75913

The flaw affects CodeWhale older than 0.8.64 and can expose files the product should not reveal.

Severity
CriticalCVSS 3.1 · 9.3
Fix
Fixed in 0.8.41, 0.8.64Fix recorded on Aug 26, 2026
Affected versions
0.3.27 or newer and 0.8.41 or older; 0.3.27 or newer, but before 0.8.41; 0.8.41 or newer, but before 0.8.64+1 more
Weakness
CWE-73
Exploit likelihood
0.33% in 30 daysEPSS, higher than 26% of known flaws
Affects
CodeWhale

How it works

Because the tool is registered as auto-approved and advertised as read-only, an attacker (via a malicious repository combined with prompt injection) can cause an unprompted arbitrary file write at the privilege of the invoking user, targeting sensitive files such as ~/.ssh/authorized_keys, ~/.bashrc, or ~/.gitconfig.

What to do

Check whether the installed CodeWhale version is older than 0.8.64.

Update CodeWhale to 0.8.64 or newer. Then verify the installed version.

Technical details

The source identifies CodeWhale as the affected product. Affected ranges: older than 0.8.64. Fixed versions: 0.8.64.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction Required Requires another user to take an action
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact None No data disclosure
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H Open in FIRST.org calculator

References

View Original Source