CVE-2026-75912: CodeWhale before 0.8.64 Argument Injection via git_blame
CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the gitblame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files such as SSH keys and credentials through the tool output returned to the model.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CodeWhale (git_blame tool)to a version that resolves this vulnerability.Fixed in 0.8.64
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running a CodeWhale version earlier than 0.8.64 are affected if an attacker can cause a value to be supplied to the git_blame tool's rev parameter. The issue can be exploited remotely with low complexity and requires no attacker privileges, but it does require user interaction.
What does an attacker need to do to exploit this?
An attacker needs to provide a crafted rev value containing Git options, such as --contents=/path/to/file. The unvalidated value can cause git_blame to read the specified file, and its contents are returned through the tool output to the model.
What is the remediation?
Upgrade CodeWhale to version 0.8.64 or later. The provided data does not identify an alternative mitigation for deployments that cannot be upgraded immediately.