CVE-2026-75914: CodeWhale before 0.8.64 Path Traversal via image_analyze symlink
CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the imageanalyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without user approval.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CodeWhale (image_analyze tool)to a version that resolves this vulnerability.Fixed in 0.8.64
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
Instances running a CodeWhale version earlier than 0.8.64 are affected when an attacker can create a symlink in a workspace and invoke the image_analyze tool against it. The symlink must target an external file whose name has an image extension.
Does exploitation require user interaction or approval?
No user approval is required once the attacker can use the vulnerable tool and create the workspace symlink. The tool can read bytes from the symlink target and send them to the vision endpoint.
What is the remediation?
Upgrade CodeWhale to version 0.8.64 or later. The provided data does not identify a separate mitigation for environments that cannot upgrade immediately.