Hmbown CodeWhale coding agent could leak files via symlinks

Published September 4, 2026 CVE-2026-75914

CodeWhale is an AI coding assistant that runs in a terminal. A flaw let a booby-trapped project trick it into reading files outside the project folder and sending their contents to CodeWhale's own image-description feature, without asking the developer first.

Severity
HighCVSS 3.1 · 7.5
Fix
Fixed in 0.8.41, 0.8.64Fix recorded on Sep 4, 2026
Affected versions
0.8.32 or newer and 0.8.41 or older; 0.8.32 or newer, but before 0.8.41; 0.8.41 or newer, but before 0.8.64+1 more
Weakness
CWE-22Path Traversal
Exploit likelihood
0.42% in 30 daysEPSS, higher than 36% of known flaws
Affects
codewhale-tui+1 more

How it works

CodeWhale's image_analyze feature let a project folder contain a shortcut-like file (a symlink) with an image-sounding name that actually points to a file elsewhere on the computer, and CodeWhale read through it without checking where it really led.

What to do

Check your installed CodeWhale version with codewhale --version (or npm ls codewhale) and compare it against 0.8.64; deepseek-tui users should compare against 0.8.41.

Run this in the application environment you want to check:

npm ls codewhale

Update to codewhale 0.8.64 or later (or deepseek-tui 0.8.41 or later) using npm install codewhale@latest or your Cargo/Homebrew update channel, especially before opening projects you did not create yourself.

Technical details

Affected software: codewhale-tui, deepseek-tui

The image_analyze tool resolved its image_path argument with a bare workspace join instead of the project's normal path-resolution routine, and only checked for absolute paths, drive prefixes, and parent-directory segments before reading the file. It never canonicalized symlinks, so a symlink inside the workspace with an image-like extension could point outside the workspace and still be read. Because the tool is marked read-only, it auto-approves without a user prompt, so the out-of-workspace file's bytes get sent to the vision endpoint silently. Fixed in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e, shipped in codewhale/codewhale-tui 0.8.64 and deepseek-tui 0.8.41.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact None No data tampering
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Open in FIRST.org calculator

References

View Original Source