Vulnerability Description
CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files such as SSH keys and credentials through the tool output returned to the model.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/Hmbown/CodeWhale/commit/9a34b5034d29f05d1f28fa61b04719ca6a741
- https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-c6mw-8xh8-gpq6
- https://www.vulncheck.com/advisories/codewhale-before-argument-injection-via-git
- https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-c6mw-8xh8-gpq6
FAQ
What is CVE-2026-75912?
CVE-2026-75912 is a vulnerability with a CVSS score of 7.4 (HIGH). CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev param...
How severe is CVE-2026-75912?
CVE-2026-75912 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-75912?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.