CVE-2026-75912
CodeWhale before 0.8.64 Argument Injection via git_blame
CVSS Score
7.4
EPSS Score
0.0%
EPSS Percentile
0th
CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files such as SSH keys and credentials through the tool output returned to the model.
| CWE | CWE-88 |
| Vendor | hmbown |
| Product | codewhale |
| Published | Aug 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for hmbown codewhale
Be the first to know when new high vulnerabilities affecting hmbown codewhale are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
Hmbown / CodeWhale
0.3.27 < 0.8.41
Hmbown / CodeWhale
0.3.27 < 0.8.41
Hmbown / CodeWhale
0.8.41 < 0.8.64
Hmbown / CodeWhale
0.8.41 < 0.8.64
References
Credits
🔍 0xEr3n