CVE-2026-75912
HighCVSS 7.4Summary
CodeWhale before version 0.8.64 contains an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files such as SSH keys and credentials.
Risk Assessment
The ability to read arbitrary files can lead to theft of credentials and private keys, enabling unauthorized access to systems.
Recommendation
Update CodeWhale to version 0.8.64 or later, which includes the fix.
Original NVD description (English source)
CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files such as SSH keys and credentials through the tool output returned to the model.