Argument Injection in CodeWhale git_show Tool

Executive Summary

CVE-2026-75913 is an argument injection vulnerability in CodeWhale's git_show tool affecting versions >=0.8.41 and <0.8.64. The rev parameter, supplied by the model, is passed unvalidated into the git show command without an --end-of-options sentinel. Attackers can exploit this by using values like --output= to write arbitrary files on the user's system, including sensitive files such as ~/.ssh/authorized_keys or ~/.bashrc.

Useful 0 Not Useful 0

Detection Guidance

Check CodeWhale version with npm list codewhale or cargo list codewhale-tui. If version is >=0.8.41 and <0.8.64, the system is vulnerable. Review git_show tool usage in logs for suspicious --output= flags or file writes to sensitive paths like ~/.ssh/authorized_keys.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to write arbitrary files to your system without your approval, even though the tool is advertised as read-only. Sensitive files like SSH keys, shell configurations, or Git settings could be overwritten, potentially leading to unauthorized access or system compromise. Exploitation requires a malicious repository and prompt injection.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized file writes, potentially exposing sensitive data or system configurations. For GDPR, it may violate integrity and confidentiality principles. For HIPAA, unauthorized file access could compromise protected health information. Compliance risks depend on the specific data affected and organizational policies.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade CodeWhale to version 0.8.64 or later. If upgrading is not possible, disable auto-approval for git_show tool and add --end-of-options sentinel to git show commands. Avoid using untrusted repositories with CodeWhale.

Useful 0 Not Useful 0