CVE-2026-75915: CodeWhale before 0.8.64 Environment Variable Leak via js_execution
CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the jsexecution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API keys, cloud credentials, and authentication tokens back to the model context.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CodeWhale js_execution toolto a version that resolves this vulnerability.Fixed in 0.8.64 - Compensating control
Use a CodeWhale version >= 0.8.64 (the fix for Environment Variable Leak via js_execution) to prevent malicious JavaScript executed by js_execution from accessing unsanitized parent process environment variables and leaking API keys, cloud credentials, and authentication tokens.
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running CodeWhale versions before 0.8.64 are affected when the js_execution tool can execute attacker-crafted JavaScript. The issue can expose environment variables inherited from the parent process, including API keys, cloud credentials, and authentication tokens.
What does an attacker need to exploit this?
An attacker needs to cause malicious JavaScript to be executed through js_execution. No authentication or user interaction is required according to the supplied severity vector.
What is the remediation?
Upgrade CodeWhale to version 0.8.64 or later. The affected behavior is present in versions before 0.8.64.
How can I assess potential impact?
Treat any secrets present in the parent process environment of affected CodeWhale instances as potentially exposed, particularly API keys, cloud credentials, and authentication tokens. Review whether untrusted JavaScript was executed through js_execution and rotate exposed credentials as appropriate.