CVE-2026-75914
HighCVSS 7.5Summary
CodeWhale before version 0.8.64 contains a path traversal vulnerability in the image_analyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without user approval.
Risk Assessment
File content leakage can expose sensitive data, such as configuration files or user data, compromising information confidentiality.
Recommendation
Update CodeWhale to version 0.8.64 or later, which includes the fix.
Original NVD description (English source)
CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without user approval.