CVE-2026-75859: CodeWhale Path Traversal Vulnerability

CVE-2026-75859 Overview

CVE-2026-75859 is an arbitrary file read vulnerability in CodeWhale versions before 0.8.64. The flaw resides in how the application processes the project configuration instructions field. CodeWhale fails to validate file paths declared in the .codewhale/config.toml file, allowing attackers to specify paths outside the workspace boundary. A malicious repository can weaponize this behavior to read arbitrary files from a victim's system when the project is cloned and opened. The referenced file contents are then injected into the AI system prompt, creating a channel for data exfiltration to attacker-controlled infrastructure. The vulnerability is classified under CWE-22 (Path Traversal).

Critical Impact
Cloning a malicious repository is sufficient to expose SSH keys, credentials, and other sensitive files to an attacker via AI prompt injection.

Affected Products

CodeWhale versions prior to 0.8.64
Developer workstations that clone untrusted repositories using CodeWhale
AI-assisted coding environments integrating CodeWhale project configuration

Discovery Timeline

2026-08-18 - CVE-2026-75859 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-75859

Vulnerability Analysis

CodeWhale reads project-scoped instructions from a .codewhale/config.toml file located in the workspace. The instructions field supports referencing external files whose contents are appended to the AI system prompt. Before version 0.8.64, CodeWhale did not constrain these file paths to the project workspace. An attacker who controls a repository can craft the configuration to reference absolute paths or use directory traversal sequences such as ../../. When the victim opens the cloned repository, CodeWhale reads the targeted files and injects their contents into the model's system prompt. The AI backend then processes the prompt, and the exfiltration path completes when the model output or telemetry reaches attacker-controlled infrastructure. The EPSS score is 0.414% at the 34.8 percentile.

Root Cause

The root cause is missing path validation for file references in the instructions field of .codewhale/config.toml. The application resolves user-supplied paths without enforcing a workspace boundary or canonicalizing the path against an allowlist. This condition matches CWE-22, where external input constructs a pathname intended to identify a file beneath a restricted directory but insufficient neutralization allows escape.

Attack Vector

Exploitation requires the victim to clone and open a repository controlled by the attacker. The malicious .codewhale/config.toml file specifies target files such as ~/.ssh/id_rsa, ~/.aws/credentials, or /etc/passwd. When CodeWhale initializes the project, the file contents are read and inserted into the AI system prompt. Because the attack vector is network-based and requires no authentication or user interaction beyond opening the project, the attack surface aligns with typical supply chain and social engineering flows targeting developers. Refer to the VulnCheck Advisory and the GitHub Security Advisory for the vendor's technical description.

Detection Methods for CVE-2026-75859

Indicators of Compromise

Presence of .codewhale/config.toml files containing absolute paths or ../ sequences in the instructions field.
CodeWhale process activity reading sensitive files such as ~/.ssh/, ~/.aws/, ~/.config/, or /etc/ shortly after a repository clone.
Outbound network traffic from CodeWhale AI backends carrying content matching local secret file patterns.
Recently cloned repositories from untrusted sources containing hidden .codewhale directories.

Detection Strategies

Scan repositories for .codewhale/config.toml files and flag any instructions entries referencing paths outside the workspace.
Monitor file access telemetry for the CodeWhale binary reading files under user home directories that are unrelated to the active project.
Correlate git clone events with subsequent access to credential and key material within a short time window.

Monitoring Recommendations

Log file-read operations performed by AI coding assistants and alert on paths outside the current workspace root.
Track and inventory installed CodeWhale versions across developer endpoints to identify systems running builds earlier than 0.8.64.
Enable egress monitoring on developer workstations for AI service endpoints and inspect for uploaded secrets.

How to Mitigate CVE-2026-75859

Immediate Actions Required

Upgrade CodeWhale to version 0.8.64 or later on all developer workstations.
Audit existing repositories for malicious .codewhale/config.toml files before opening them in the editor.
Rotate any credentials, SSH keys, and API tokens that may have been exposed on hosts running vulnerable versions.

Patch Information

The fix is available in CodeWhale 0.8.64. The upstream patch is documented in the GitHub Commit Reference and detailed in the GitHub Security Advisory. The patch enforces workspace-relative path validation for the instructions field, rejecting absolute paths and traversal sequences.

Workarounds

Do not open untrusted repositories in CodeWhale until the upgrade is applied.
Inspect and remove suspicious .codewhale/config.toml files from cloned projects before opening them.
Run CodeWhale under a restricted user account that lacks read access to sensitive credential stores.

bash

# Configuration example: audit repositories for suspicious CodeWhale instructions
find . -path '*/.codewhale/config.toml' -exec grep -HnE '(\.\./|^/|~/)' {} \;