CVE-2026-75912

CodeWhale before 0.8.64 Argument Injection via git_blame

State: Published
Severity: 8.3 High
Published: Aug 18, 2026
Updated: Aug 19, 2026
Reserved: Aug 18, 2026

Description

CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files such as SSH keys and credentials through the tool output returned to the model.

Scores

CVSS	Score	Vector	Source
4.0	8.3 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N	VulnCheck
3.1	7.4 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N	VulnCheck

Weaknesses

CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Affected Products

Product	Versions
CodeWhaleHmbown	0.3.27 to before 0.8.41Affected 0.8.41Not affected
CodeWhaleHmbown	0.3.27 to before 0.8.41Affected 0.8.41Not affected
CodeWhaleHmbown	0.8.41 to before 0.8.64Affected 0.8.64Not affected
CodeWhaleHmbown	0.8.41 to before 0.8.64Affected 0.8.64Not affected

References

GitHub Security Advisory (GHSA-c6mw-8xh8-gpq6)vendor-advisory
Patch Commitpatch
VulnCheck Advisory: CodeWhale before 0.8.64 Argument Injection via git_blamethird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.