CVE-2026-75912

Name of the Vulnerable Software and Affected Versions CodeWhale versions prior to 0.8.64

Description An argument injection flaw exists in the git blame tool. This occurs because the rev parameter is not properly validated, allowing attackers to inject git options. By providing specific values to the rev parameter, such as --contents=/path/to/file, an attacker can read arbitrary files from the system, potentially exfiltrating sensitive data like SSH keys and credentials via the tool output returned to the model.

Recommendations Update CodeWhale to version 0.8.64 or later. As a temporary mitigation, restrict or validate the input passed to the rev parameter in the git blame tool.