CVE-2026-75913: CodeWhale TUI RCE Vulnerability

CVE-2026-75913 Overview

CVE-2026-75913 is an argument injection vulnerability in CodeWhale (codewhale / codewhale-tui) affecting versions >= 0.8.41 and < 0.8.64. The git_show tool passes the model-supplied rev parameter directly into the git show argv without an --end-of-options sentinel. A rev value beginning with --output= is interpreted as a git flag rather than a revision. Because git_show is registered as auto-approved and advertised as read-only, a malicious repository combined with prompt injection can trigger an arbitrary file write with the invoking user's privileges. Attackers can target sensitive files such as ~/.ssh/authorized_keys, ~/.bashrc, or ~/.gitconfig. The issue is categorized under [CWE-73] (External Control of File Name or Path).

Critical Impact
Unprompted arbitrary file write as the invoking user, enabling persistence, shell hijacking, and SSH key implantation through a supposedly read-only tool.

Affected Products

CodeWhale (codewhale) versions >= 0.8.41 and < 0.8.64
CodeWhale TUI (codewhale-tui) versions >= 0.8.41 and < 0.8.64
Fixed in CodeWhale 0.8.64

Discovery Timeline

2026-08-18 - CVE CVE-2026-75913 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-75913

Vulnerability Analysis

The git_show tool exposes a rev parameter that the language model can populate directly. The tool invokes git show with the user-controlled rev value as a positional argument, but does not insert a --end-of-options sentinel to separate flags from revisions. git show therefore treats any rev starting with -- as an option.

Git supports options such as --output=<file> on subcommands that write diff output. When the auto-approved tool forwards a rev like --output=/home/user/.ssh/authorized_keys, git writes attacker-controlled diff content to that file. The tool is advertised as read-only, so no confirmation prompt is shown to the user.

Root Cause

The root cause is missing validation on the rev argument in crates/tui/src/tools/git_history.rs. Neither a syntactic check nor an argv boundary (--end-of-options or --) was present before the value reached the git process. Combined with the auto-approval policy for read-only tools, the missing check turns argument injection into an unattended write primitive.

Attack Vector

An attacker publishes a repository whose contents (README, commit messages, or file bodies) contain prompt injection payloads. When a user opens the repository in CodeWhale, the model reads attacker-controlled text and invokes git_show with a malicious rev such as --output=~/.bashrc. Because the tool is auto-approved, execution proceeds without a prompt and git writes attacker-controlled bytes to the target file.

rust

 async fn execute(&self, input: Value, context: &ToolContext) -> Result<ToolResult, ToolError> {
     let rev = required_str(&input, "rev")?;
+    validate_git_rev(rev)?;
     let git_ctx = resolve_git_context(context, optional_str(&input, "path"))?;
     let patch = optional_bool(&input, "patch", true);
     let stat = optional_bool(&input, "stat", true);

Source: GitHub commit 9a34b50. The patch adds validate_git_rev(rev)? before the value reaches the git invocation.

Detection Methods for CVE-2026-75913

Indicators of Compromise

Unexpected modifications to ~/.ssh/authorized_keys, ~/.bashrc, ~/.zshrc, or ~/.gitconfig on hosts running CodeWhale.
git show process invocations where argv contains a rev token beginning with --output=, --upload-pack=, or other flag-shaped values.
New SSH keys present in authorized_keys that were not added by the account owner.
Cloned repositories containing README or commit content that resembles prompt injection instructions targeting the git_show tool.

Detection Strategies

Alert on child processes of codewhale or codewhale-tui where the command line matches git show --output= or contains --output= as a positional revision.
Monitor file integrity on shell startup files and SSH configuration under user home directories.
Inventory installed CodeWhale versions across developer workstations and flag any release between 0.8.41 and 0.8.63 inclusive.

Monitoring Recommendations

Enable process command-line auditing (Sysmon on Windows, auditd on Linux, endpointsecurity on macOS) for the CodeWhale binary and its children.
Forward file-write telemetry on user dotfiles to a central log store for retrospective analysis.
Track outbound git operations against untrusted or newly cloned repositories.

How to Mitigate CVE-2026-75913

Immediate Actions Required

Upgrade codewhale and codewhale-tui to version 0.8.64 or later on all developer endpoints.
Audit ~/.ssh/authorized_keys, ~/.bashrc, ~/.zshrc, and ~/.gitconfig on hosts that ran affected versions and revoke unrecognized SSH keys.
Rotate SSH keys and any credentials referenced by the affected shell configuration files.

Patch Information

The fix is delivered in CodeWhale 0.8.64 and adds rev validation in crates/tui/src/tools/git_history.rs. See the GitHub Security Advisory GHSA-7j5w-7r7x-9v27, the upstream commit, and the VulnCheck advisory.

Workarounds

Remove git_show from the auto-approved tool list so each invocation requires explicit user confirmation.
Restrict CodeWhale usage to trusted repositories until the upgrade is deployed.
Run CodeWhale under a dedicated low-privilege account that has no access to sensitive dotfiles or SSH material.

bash

# Upgrade CodeWhale to the patched release
cargo install codewhale-tui --version 0.8.64 --force
codewhale --version   # verify 0.8.64 or later

# Audit for suspicious modifications on affected hosts
for f in ~/.ssh/authorized_keys ~/.bashrc ~/.zshrc ~/.gitconfig; do
  [ -f "$f" ] && stat -c '%y %n' "$f"
done