Environment Variable Exposure Vulnerability in CodeWhale by Hmbown

CVE-2026-75915

What is CVE-2026-75915?

CodeWhale, a tool developed by Hmbown, is vulnerable to an environment variable exposure due to inadequate scrubbing of parent process environment variables within its js_execution tool. This oversight allows attackers to inject malicious JavaScript code that can then access sensitive data in the process environment, such as API keys, cloud credentials, and authentication tokens. The vulnerability could lead to significant security breaches if exploited, as attackers can leverage this leaked information for unauthorized access to systems and sensitive resources.

References