An unvalidated rev parameter in CodeWhale's auto-approved, "read-only" git_show tool lets a malicious repository combined with prompt injection write arbitrary files as the invoking user.
What Is It
CodeWhale (codewhale / codewhale-tui) passes the model-supplied rev parameter directly into the git show argv without an --end-of-options sentinel. A value beginning with --output= is therefore parsed by git as a flag rather than a revision, turning a read operation into a file write. The flaw is tracked as CWE-73 (External Control of File Name or Path) and carries a CVSS 3.1 base score of 9.3 (CRITICAL, AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H), with a secondary CVSS 4.0 score of 8.5 (HIGH).
Why It Matters
The git_show tool is registered as auto-approved and advertised to the user as read-only, so exploitation happens with no approval prompt. An attacker who controls a repository and lands a prompt injection can trigger an unprompted arbitrary file write at the privilege of the invoking user; with named targets including ~/.ssh/authorized_keys, ~/.bashrc, and ~/.gitconfig. Writing to any of those could plausibly convert a code-review session into persistent access on the developer's machine, though whether it does in practice depends on how much of the written content the attacker controls and on the local environment. Scope is rated Changed and both integrity and availability impact are High.
CISA's SSVC assessment records exploitation status as poc (proof-of-concept), automatable no, and technical impact total. No CISA KEV entry was supplied for this CVE, so there is no confirmation of active in-the-wild exploitation at this time.
What's Vulnerable
pkg:cargo/codewhale-tui, >= 0.8.41, < 0.8.64pkg:npm/codewhale, >= 0.8.41, < 0.8.64pkg:cargo/deepseek-tui, >= 0.3.27, < 0.8.41 (listed affected)pkg:npm/deepseek-tui, >= 0.3.27, < 0.8.41 (listed affected)
Vendor: Hmbown.
Patch Status
Fixed in 0.8.64, which adds validation of the rev parameter. Upgrade any codewhale or codewhale-tui install in the affected range to 0.8.64 or later. No workaround is documented in the advisory; no KEV due date or required action applies, as the CVE is not in the supplied KEV catalog.
Sources
- NVD, CVE-2026-75913 (source: [email protected], published 2026-08-18)
- GitHub Security Advisory GHSA-7j5w-7r7x-9v27: https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-7j5w-7r7x-9v27
- Fix commit: https://github.com/Hmbown/CodeWhale/commit/9a34b5034d29f05d1f28fa61b04719ca6a741020
- VulnCheck Advisory: https://www.vulncheck.com/advisories/codewhale-before-argument-injection-via-git-show