CVE-2026-75914 Hmbown CVE debrief

Who should care

Defenders responsible for CodeWhale installations, security teams, and developers using the CodeWhale library should prioritize verifying and updating CodeWhale installations, restricting access to the vision endpoint, and monitoring for suspicious activity. This vulnerability affects CodeWhale installations and requires immediate attention from defenders. The vulnerability can be exploited by attackers to leak file bytes to the vision endpoint withoutuser

Why it matters

CVE-2026-75914 is a path traversal vulnerability in CodeWhale versions before 0.8.64, allowing attackers to leak file bytes to the vision endpoint without user approval. Defenders should prioritize verifying and updating CodeWhale installations, restricting access to the vision endpoint, and monitoring for suspicious activity.

• Potential data leakage through file byte exposure
• Possible unauthorized access to sensitive files
• Required verification of CodeWhale installations and updates
• Potential impact on vision endpoint security

Technical summary

The image_analyze tool in CodeWhale versions before 0.8.64 fails to canonicalize symlinks before reading files, allowing attackers to leak file bytes to the vision endpoint without user approval. This vulnerability is a path traversal issue that can be exploited by creating workspace symlinks pointing to external files with image extensions. Defenders should prioritize verifying and updating CodeWhale installations to version 0.8.64 or later, and restrict access to the vision endpoint. The CVE record and NVD entry provide details on the vulnerability.

Defensive priority

Defenders should prioritize verifying and updating CodeWhale installations to version 0.8.64 or later, and restrict access to the vision endpoint.

Recommended defensive actions

• Verify CodeWhale installations and update to version 0.8.64 or later
• Restrict access to the vision endpoint
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but do not specify which versions are affected or provide remediation steps. The vulnerability is a path traversal issue in the image_analyze tool of CodeWhale versions before 0.8.64. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without user approval. Defenders should verify CodeWhale installations, restrict access to the vision endpoint, and monitor for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.