CVE-2026-75915 Hmbown CVE debrief

Who should care

Defenders responsible for CodeWhale deployments should assess exposure and prioritize verification and mitigation of this vulnerability. This includes reviewing the current version of CodeWhale in use, upgrading to version 0.8.64 or later if necessary, and restricting access to sensitive information stored in environment variables. Additionally, defenders should monitor for suspicious activity related to the js_execution tool and review compensating and  

Why it matters

CVE-2026-75915 is a high-severity vulnerability in CodeWhale that allows attackers to leak sensitive information. Defenders responsible for CodeWhale deployments should assess exposure and prioritize verification and mitigation of this vulnerability.

• Potential leakage of sensitive information such as API keys, cloud credentials, and authentication tokens
• Possible exploitation by attackers to gain unauthorized access to sensitive information
• Need for verification of CodeWhale version and upgrade to version 0.8.64 or later
• Potential impact on cloud security and data protection

Technical summary

The js_execution tool in CodeWhale versions before 0.8.64 fails to scrub parent process environment variables before spawning Node.js, allowing attackers to craft malicious JavaScript code to read process.env and leak sensitive information such as API keys, cloud credentials, and authentication tokens. This vulnerability can be mitigated by verifying the version of CodeWhale in use and upgrading to version 0.8.64 or later. Additionally, defenders should review and restrict access to sensitive information stored in environment variables and monitor for suspicious activity related to the js_execution tool.

Defensive priority

Defenders should prioritize verifying the version of CodeWhale in use and upgrading to version 0.8.64 or later to mitigate this vulnerability.

Recommended defensive actions

• Verify the version of CodeWhale in use and upgrade to version 0.8.64 or later
• Review and restrict access to sensitive information stored in environment variables
• Monitor for suspicious activity related to the js_execution tool
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is confirmed by the CVE Program and NVD. The source references provide additional information about the vulnerability, including a commit that fixes the issue and a security advisory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.