CVE-2026-75914

Received Received - Intake

Path Traversal in CodeWhale Image Analyze Tool

Publication date: 2026-08-18

Last updated on: 2026-08-20

Assigner: VulnCheck

Description

CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without user approval.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-20

Generated

2026-09-07

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-06

NVD

CVE-2026-75914

EUVD

EUVD-2026-60972

Affected Vendors & Products

Vendor	Product	Version / Range
codewhale	codewhale	to 0.8.64 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CVE-2026-75914 is a path traversal vulnerability in CodeWhale versions before 0.8.64. The image_analyze tool fails to properly handle symlinks, allowing attackers to create malicious symlinks in a workspace that point to external files with image extensions. This lets the tool read those external files without user approval and leak their contents to the vision endpoint.

Detection Guidance

Check CodeWhale version with npm list codewhale or codewhale --version. Inspect workspace symlinks pointing to external files with image extensions. Monitor vision endpoint traffic for unexpected file reads or base64-encoded payloads.

Impact Analysis

If you use affected CodeWhale versions, attackers could exploit this to access sensitive files on your system without your knowledge. The leaked file bytes are sent to external endpoints, potentially exposing confidential data to providers, corporate proxies, or attackers intercepting traffic.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations may face compliance violations, legal penalties, and reputational damage if sensitive data is leaked through this flaw.

Mitigation Strategies

Upgrade CodeWhale to version 0.8.64 or later. Replace path resolution in image_analyze to use context.resolve_path instead of context.workspace.join. Restrict workspace symlink creation and validate all image paths.

Hi! I’m here to help you understand CVE-2026-75914. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70