Argument Injection Vulnerability in CodeWhale by Hmbown

CVE-2026-75913

What is CVE-2026-75913?

CodeWhale versions between 0.8.41 and 0.8.63 exhibit a significant security flaw due to an argument injection vulnerability in the git_show tool. This occurs when the model-supplied rev parameter is improperly passed into the git show command without validation. An attacker could exploit this by craftily manipulating repository inputs to execute commands that allow unprompted arbitrary file writes, potentially targeting sensitive user configuration files like ~/.ssh/authorized_keys and ~/.bashrc. This vulnerability was addressed in version 0.8.64 through the implementation of rev parameter validation.

References