CVE-2026-75915: CodeWhale Information Disclosure Flaw

CVE-2026-75915 Overview

CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool. The tool fails to scrub parent process environment variables before spawning Node.js child processes. Attackers can craft malicious JavaScript executed by the tool to read process.env and leak API keys, cloud credentials, and authentication tokens back to the model context. The flaw is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Attackers can exfiltrate API keys, cloud provider credentials, and authentication tokens from the host process environment by supplying malicious JavaScript to the CodeWhale js_execution tool.

Affected Products

CodeWhale versions prior to 0.8.64
The js_execution tool within the CodeWhale TUI crate
Node.js child processes spawned by CodeWhale inheriting parent environment

Discovery Timeline

2026-08-18 - CVE-2026-75915 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-75915

Vulnerability Analysis

CodeWhale exposes a js_execution tool that spawns Node.js to run JavaScript supplied by an AI model or user. Before version 0.8.64, the spawning code did not sanitize the parent process environment. Node.js inherited every variable defined in the CodeWhale host, including secrets such as AWS_ACCESS_KEY_ID, GITHUB_TOKEN, OPENAI_API_KEY, and other credentials commonly present in developer shells.

A malicious model-generated or attacker-controlled script only needs to read process.env and return the object. The tool then relays that output back to the model context, effectively leaking secrets to any component that observes tool responses. Because credentials often grant access to production infrastructure, a successful exfiltration extends the blast radius beyond the local host.

Root Cause

The root cause is missing environment scrubbing before invoking tokio::process::Command. The pre-patch helper apply_node_proxy_env only added proxy overrides and left all other inherited variables untouched. The fix introduces apply_node_execution_env, which delegates to a dedicated child_env module that applies an allowlist to the child command.

Attack Vector

The attack is remote and requires no authentication or user interaction when the CodeWhale agent is exposed to untrusted model input. An adversary who can influence the JavaScript payload sent to js_execution requests a script that serializes process.env and returns the value. Tool output is then surfaced through the model context, which the attacker can observe or exfiltrate.

rust

// Patched implementation from crates/tui/src/tools/js_execution.rs
// Replaces the old apply_node_proxy_env helper that leaked the full parent env.

     node_proxy_env_overrides_from(|key| std::env::var_os(key))
 }

-fn apply_node_proxy_env(cmd: &mut tokio::process::Command) {
-    for (key, value) in node_proxy_env_overrides() {
-        cmd.env(key, value);
-    }
+fn apply_node_execution_env(cmd: &mut tokio::process::Command) {
+    crate::child_env::apply_to_tokio_command(cmd, node_proxy_env_overrides());
 }

 /// Build the `Tool` definition the catalog should advertise when

Source: GitHub Commit 26de44a

The companion patch in crates/tui/src/tools/fetch_url.rs also hardens DNS resolution to prevent trust-boundary bypass during URL fetches, closing a related exfiltration channel.

Detection Methods for CVE-2026-75915

Indicators of Compromise

Tool responses from js_execution that contain serialized process.env output or key-value patterns matching credential names.
Outbound network connections from CodeWhale-spawned Node.js processes to unexpected destinations.
Model transcripts referencing tokens such as AWS_, AZURE_, GITHUB_TOKEN, or _API_KEY prefixes originating from tool output.

Detection Strategies

Inspect CodeWhale audit logs for js_execution invocations that access process.env, Object.keys(process.env), or JSON.stringify(process.env).
Correlate Node.js child process telemetry with parent CodeWhale versions less than 0.8.64 to identify vulnerable hosts.
Rotate and monitor any secret that resided in the environment of a CodeWhale host running a pre-patch version.

Monitoring Recommendations

Alert on tool outputs whose payload size or content matches credential exfiltration heuristics.
Track version strings reported by CodeWhale instances and flag deployments below 0.8.64.
Enable egress monitoring on developer workstations running AI coding agents to detect anomalous destinations.

How to Mitigate CVE-2026-75915

Immediate Actions Required

Upgrade CodeWhale to version 0.8.64 or later on every host where the TUI or js_execution tool is available.
Rotate all API keys, cloud credentials, and authentication tokens that were present in the environment of any pre-patch CodeWhale process.
Restrict which secrets are exported into the shells that launch CodeWhale, following least-privilege principles.

Patch Information

The fix is delivered in commit 26de44a8 and documented in the GitHub Security Advisory GHSA-h539-c7r8-3xq4. The patch replaces the permissive apply_node_proxy_env helper with apply_node_execution_env, which routes through a new child_env module enforcing an allowlist for variables passed to Node.js. See also the Vulncheck advisory.

Workarounds

Launch CodeWhale from a wrapper shell that unsets sensitive variables before invocation, leaving only variables Node.js requires.
Disable or gate the js_execution tool until upgrading, preventing untrusted models from executing JavaScript.
Run CodeWhale inside a container or sandbox with a minimal environment and no long-lived credentials mounted.

bash

# Wrapper example: strip secrets before launching CodeWhale
env -i \
  PATH="/usr/local/bin:/usr/bin:/bin" \
  HOME="$HOME" \
  TERM="$TERM" \
  codewhale "$@"

# Verify installed version is patched
codewhale --version   # expect 0.8.64 or later