CVE-2026-75912

Received Received - Intake

Code Injection in CodeWhale Git Blame Tool

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: VulnCheck

Description

CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files such as SSH keys and credentials through the tool output returned to the model.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-07

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-06

NVD

CVE-2026-75912

EUVD

EUVD-2026-60970

Affected Vendors & Products

Vendor	Product	Version / Range
codewhale	codewhale	to 0.8.64 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-88	The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

Executive Summary

CVE-2026-75912 is an argument injection vulnerability in CodeWhale versions before 0.8.64. The git_blame tool fails to validate the rev parameter, allowing attackers to inject malicious git options like --contents=/path/to/file. This lets them read arbitrary files on the system, including sensitive files such as SSH keys or credentials, through the tool's output.

Detection Guidance

Check CodeWhale version with 'codewhale --version' or 'pip show codewhale'. If version is below 0.8.64, the system is vulnerable. Monitor git_blame tool usage for unexpected file reads or suspicious rev parameters containing '--contents' or other git options.

Impact Analysis

If you use CodeWhale versions before 0.8.64, attackers could exploit this flaw to access sensitive files on your system without your approval. This includes private keys, configuration files, or credentials, which could lead to further attacks like unauthorized access or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR (data protection) or HIPAA (health information privacy). Organizations using affected versions may face legal penalties, reputational damage, and loss of trust due to data exposure.

Mitigation Strategies

Upgrade CodeWhale to version 0.8.64 or later immediately. If upgrading is not possible, restrict access to the git_blame tool and review all rev parameters for injected options. Disable auto-approval settings and implement input validation to reject rev values starting with hyphens.

Hi! I’m here to help you understand CVE-2026-75912. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70