Description
CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files such as SSH keys and credentials through the tool output returned to the model.
Metrics
CVSS 3.1 7.4/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Hmbown | CodeWhale | >= 0.3.27, < 0.8.41 |
| Hmbown | CodeWhale | >= 0.3.27, < 0.8.41 |
| Hmbown | CodeWhale | >= 0.8.41, < 0.8.64 |
| Hmbown | CodeWhale | >= 0.8.41, < 0.8.64 |
References
- https://github.com/Hmbown/CodeWhale/commit/9a34b5034d29f05d1f28fa61b04719ca6a741020
- https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-c6mw-8xh8-gpq6
- https://www.vulncheck.com/advisories/codewhale-before-argument-injection-via-git-blame
- https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-c6mw-8xh8-gpq6
Timeline
- Published
- Aug 18, 2026
- Last modified
- Oct 22, 2026
- NVD status
- Deferred