CVE-2026-75859
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and injected into the AI system prompt for exfiltration.
Risk Assessment
An attacker can access sensitive files on the user's machine, such as keys, passwords, or configuration data, potentially leading to confidentiality breaches and further attacks.
Recommendation
Update CodeWhale to version 0.8.64 or later, which includes a fix for file path validation. Be cautious when opening repositories from untrusted sources.
Original NVD description (English source)
CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and injected into the AI system prompt for exfiltration.