CVE-2026-75914: CodeWhale Path Traversal Vulnerability

CVE-2026-75914 Overview

CVE-2026-75914 is a path traversal vulnerability [CWE-22] in CodeWhale versions before 0.8.64. The flaw exists in the image_analyze tool, which fails to canonicalize symbolic links before reading files. An attacker who can place workspace symlinks pointing to external files with image extensions can cause the tool to send the referenced file bytes to the vision endpoint. The action occurs without user approval, bypassing the workspace trust boundary. The vulnerability is network-reachable and requires no authentication or user interaction, making it exploitable in agentic development environments where untrusted repositories may be opened.

Critical Impact
Attackers can exfiltrate arbitrary local files from a developer's host to the remote vision endpoint by planting crafted symlinks inside the workspace.

Affected Products

CodeWhale versions before 0.8.64
The image_analyze tool within the CodeWhale TUI crate
Workspaces opened by CodeWhale that contain attacker-controlled files

Discovery Timeline

2026-08-18 - CVE-2026-75914 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-75914

Vulnerability Analysis

CodeWhale exposes an image_analyze tool that accepts a workspace-relative file path, reads the file, and forwards the bytes to a remote vision model endpoint. The tool enforces a workspace boundary by checking the supplied path prefix, but it does not resolve symbolic links before performing the read. As a result, a symlink placed inside the workspace that targets an arbitrary absolute path on the host filesystem is treated as an in-workspace file. If the symlink name carries a recognized image extension such as .png or .jpg, the tool proceeds without prompting the user. The referenced bytes, which may include SSH keys, environment files, or source code, are then transmitted to the vision endpoint.

Root Cause

The root cause is missing path canonicalization. The image_analyze handler validates the user-supplied path lexically rather than resolving it through a canonical filesystem call. Symlinks are followed transparently at read time, so the trust check and the file access disagree on which file is being touched. This is a classic time-of-check to time-of-use pattern combined with insufficient input validation.

Attack Vector

An attacker delivers a repository or archive containing a symlink such as screenshot.png pointing to /home/user/.ssh/id_rsa. When the developer or an agent invokes image_analyze on that path, CodeWhale reads the target file and uploads its contents to the configured vision service, where the attacker can retrieve them or infer contents through model responses.

rust

// Patch excerpt from crates/tui/src/tools/fetch_url.rs
// fix(tui): harden local tool trust boundaries
    let addrs = tokio::net::lookup_host((host.as_str(), 0u16))
        .await
        .map_err(|e| {
            ToolError::permission_denied(format!(
                "could not resolve host before fetch_url request: {e}"
            ))
        })?;
    let mut first_valid: Option<std::net::IpAddr> = None;
    for addr in addrs {
        validate_dns_resolved_ip(&host, &addr.ip(), context.network_policy.as_ref())?;
        if first_valid.is_none() {
            first_valid = Some(addr.ip());
        }
    }

    let Some(validated_ip) = first_valid else {
        return Err(ToolError::permission_denied(
            "host resolved to no addresses before fetch_url request",
        ));

Source: GitHub Commit 26de44a. This companion hardening in the same commit tightens DNS resolution failures in fetch_url so unresolved hosts return permission_denied rather than proceeding. The image_analyze symlink handling was tightened alongside these local tool trust-boundary fixes.

Detection Methods for CVE-2026-75914

Indicators of Compromise

Symbolic links inside a workspace whose targets are absolute paths outside the workspace, especially targets under ~/.ssh, ~/.aws, ~/.config, or /etc.
Outbound requests from a developer host to the CodeWhale vision endpoint carrying payloads that do not decode as valid images.
Repositories containing files with image extensions whose on-disk stat reports them as symlinks rather than regular files.

Detection Strategies

Inventory installed CodeWhale versions across developer endpoints and flag any release earlier than 0.8.64.
Baseline the image_analyze tool's read activity and alert on reads where the resolved path escapes the declared workspace root.
Correlate process telemetry from the CodeWhale TUI process with outbound HTTPS traffic to vision endpoints and compare byte volumes against expected image sizes.

Monitoring Recommendations

Enable file access auditing on sensitive directories such as ~/.ssh and cloud credential stores on developer workstations.
Log all agent tool invocations from CodeWhale with the requested path and the canonicalized target path for post-hoc review.
Forward endpoint and network telemetry to a centralized data lake so symlink-abuse patterns can be queried across the fleet.

How to Mitigate CVE-2026-75914

Immediate Actions Required

Upgrade CodeWhale to version 0.8.64 or later on all developer systems.
Audit existing workspaces for symlinks with image extensions and remove any that target paths outside the project root.
Restrict CodeWhale execution to workspaces cloned from trusted sources until the upgrade is deployed.

Patch Information

The fix is delivered in CodeWhale 0.8.64 and referenced in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e. See the GitHub Security Advisory GHSA-w7wx-5q49-r59w and the VulnCheck Advisory for full advisory details. The patch canonicalizes the requested path before reading and rejects targets that resolve outside the workspace root.

Workarounds

Disable or block the image_analyze tool in the CodeWhale configuration until the upgrade lands.
Run CodeWhale under a dedicated OS user with no read access to secrets, SSH keys, or cloud credentials.
Open only trusted repositories, and pre-scan cloned trees for symlinks with find . -type l before invoking any agent tool.

bash

# Detect suspect symlinks with image extensions in a workspace before use
find . -type l \( -iname '*.png' -o -iname '*.jpg' -o -iname '*.jpeg' \
    -o -iname '*.gif' -o -iname '*.webp' -o -iname '*.bmp' \) \
    -exec ls -l {} \;

# Verify installed CodeWhale version
codewhale --version