CVE-2026-75859

HIGH 7.5

CodeWhale before 0.8.64 Arbitrary File Read via instructions

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and injected into the AI system prompt for exfiltration.

CWE	CWE-22
Vendor	hmbown
Product	codewhale
Published	Aug 18, 2026

Stay Ahead of the Next One

Get instant alerts for hmbown codewhale

Be the first to know when new high vulnerabilities affecting hmbown codewhale are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

Hmbown / CodeWhale

0.8.8 < 0.8.41

Hmbown / CodeWhale

0.8.8 < 0.8.41

Hmbown / CodeWhale

0.8.41 < 0.8.64

Hmbown / CodeWhale

0.8.41 < 0.8.64

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-62f5-cp2p-vq95 github.com: https://github.com/Hmbown/CodeWhale/commit/43563356b98c6b993085554da82e77370160a31c vulncheck.com: https://www.vulncheck.com/advisories/codewhale-before-arbitrary-file-read-via-instructions

Credits

🔍 sondt99 🔍 dungNHVhust 🔍 sai-sh