CVE-2026-75912: CodeWhale Information Disclosure Flaw

CVE-2026-75912 Overview

CVE-2026-75912 is an argument injection vulnerability in CodeWhale versions before 0.8.64. The flaw resides in the git_blame tool, which passes an unvalidated rev parameter directly to the underlying git command. Attackers can inject arbitrary git options such as --contents=/path/to/file to coerce the tool into reading sensitive files. The tool output is returned to the model, enabling exfiltration of SSH keys, credentials, and other host-local secrets. The weakness is categorized under CWE-88: Improper Neutralization of Argument Delimiters in a Command.

Critical Impact
Remote attackers can read arbitrary files on the host by injecting git options into the rev parameter of the git_blame tool, exposing SSH keys and credentials through model output.

Affected Products

CodeWhale versions prior to 0.8.64
The git_blame tool exposed by the CodeWhale TUI (crates/tui/src/tools/git_history.rs)
Downstream integrations that invoke CodeWhale git history tooling with attacker-controllable input

Discovery Timeline

2026-08-18 - CVE-2026-75912 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-75912

Vulnerability Analysis

CodeWhale exposes a git_blame tool that accepts a rev parameter from the model or upstream caller. Before version 0.8.64, the tool forwarded this value directly to git without validating that it represented a legitimate revision identifier. Because git treats arguments beginning with -- as options, an attacker can supply values such as --contents=/etc/passwd or --contents=/home/user/.ssh/id_rsa to change command behavior. The resulting output is returned as tool output to the language model, which effectively channels file contents back to the attacker. The vulnerability requires user interaction, as an operator must approve or run the tool call, but no authentication is needed.

Root Cause

The execute function in git_history.rs called required_str(&input, "rev") and then passed the value into a git invocation without ensuring the string matched a safe revision pattern. Any argument-like input, including double-dash options accepted by the invoked git subcommand, was honored by the underlying process.

Attack Vector

A network-reachable attacker crafts a prompt or upstream tool payload that causes CodeWhale to invoke git_blame with a malicious rev value. The injected option redirects git to read a chosen file path, and the file contents are surfaced in the tool result returned to the model. This creates a straightforward path for exfiltration of secrets accessible to the CodeWhale process, including ~/.ssh/, .env files, and application configuration.

rust

// Security patch in crates/tui/src/tools/git_history.rs
// fix(tui): validate git history revisions

    async fn execute(&self, input: Value, context: &ToolContext) -> Result<ToolResult, ToolError> {
        let rev = required_str(&input, "rev")?;
+       validate_git_rev(rev)?;
        let git_ctx = resolve_git_context(context, optional_str(&input, "path"))?;
        let patch = optional_bool(&input, "patch", true);
        let stat = optional_bool(&input, "stat", true);

Source: GitHub commit 9a34b50. The added validate_git_rev(rev)? call rejects revision strings that do not conform to expected git reference syntax, blocking option-style inputs.

Detection Methods for CVE-2026-75912

Indicators of Compromise

git blame or git log invocations where the revision argument begins with --, especially --contents=, --output=, or --upload-pack=.
CodeWhale tool logs showing rev values that reference absolute filesystem paths rather than commit hashes, branches, or tags.
Unexpected reads of sensitive files such as ~/.ssh/id_rsa, ~/.aws/credentials, or /etc/shadow by the CodeWhale process.

Detection Strategies

Parse CodeWhale audit logs for git_blame tool calls and alert when the rev parameter fails a strict allowlist of [A-Za-z0-9._/-] characters or starts with -.
Instrument process execution telemetry to flag git child processes spawned by CodeWhale with option-style revision arguments.
Correlate model prompts that request file reads through git_blame with subsequent tool output containing high-entropy strings characteristic of private keys or tokens.

Monitoring Recommendations

Enable command-line and file-access auditing on hosts running CodeWhale, and forward events to a central analytics pipeline.
Alert on any successful reads of credential stores by the CodeWhale user context.
Track the installed CodeWhale version across development endpoints and flag any instance still running a release earlier than 0.8.64.

How to Mitigate CVE-2026-75912

Immediate Actions Required

Upgrade CodeWhale to version 0.8.64 or later on all developer and build systems.
Rotate SSH keys, API tokens, and credentials accessible to any user account that ran a vulnerable CodeWhale build.
Restrict the CodeWhale process to a least-privilege user that cannot read organization-wide secrets.

Patch Information

The fix is available in CodeWhale 0.8.64 and later. The patch adds a validate_git_rev call in crates/tui/src/tools/git_history.rs to reject revision strings that could be interpreted as git options. Details are documented in the GitHub Security Advisory GHSA-c6mw-8xh8-gpq6, the upstream commit, and the VulnCheck advisory.

Workarounds

Disable or gate the git_blame tool in CodeWhale until upgrade is complete.
Require manual operator approval before executing any git_blame call that includes a rev value beginning with - or containing filesystem path separators.
Run CodeWhale inside a sandbox or container that isolates SSH keys and credential files from the tool's working directory.

bash

# Verify the installed CodeWhale version and upgrade if needed
codewhale --version

# Example upgrade via cargo
cargo install --locked codewhale --version ">=0.8.64"

# Optional: pre-flight validation of rev inputs at the proxy layer
# Reject values that start with '-' or contain path separators
grep -E '^(--|/|\.\./)' <<< "$REV" && echo "blocked" || echo "allowed"