CVE-2026-75913 Hmbown CVE debrief

Who should care

Users of CodeWhale, particularly those with exposed or internet-facing deployments, should assess their exposure and prioritize updating to version 0.8.64 or later. System administrators and security teams responsible for CodeWhale installations should review and implement the recommended actions.

Why it matters

CVE-2026-75913 is an argument injection vulnerability in CodeWhale's git_show tool, allowing potential arbitrary file writes. Users should assess exposure, prioritize updates, and implement defensive measures.

• Potential for arbitrary file writes, including sensitive files like ~/.ssh/authorized_keys
• Possible exploitation via malicious repositories and prompt injection
• Requires verification of affected versions and potential exposure
• Remediation priority for CodeWhale installations

Technical summary

The git_show tool in CodeWhale versions >= 0.8.41 and < 0.8.64 is vulnerable to argument injection. The rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel. This allows an attacker to interpret a value beginning with --output= as a git flag, potentially leading to arbitrary file writes. The vulnerability can be exploited via a malicious repository and prompt injection, allowing an attacker to write files at the user's privilege level, targeting sensitive files like ~/.ssh/authorized_keys. The fix involves adding rev validation in version 0.8.64.

Defensive priority

High

Recommended defensive actions

• Review and update CodeWhale to version 0.8.64 or later
• Restrict access to sensitive files and directories
• Monitor for suspicious repository and prompt injection activity
• Perform a thorough review of system logs for signs of potential exploitation
• Implement additional monitoring for CodeWhale installations
• Conduct an inventory of assets using CodeWhale
• Establish a change management process for CodeWhale updates

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fix. However, the exact scope of affected systems and potential exploitation remains limited by the information available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.