CVE-2026-75913

Name of the Vulnerable Software and Affected Versions CodeWhale versions 0.8.41 through 0.8.63

Description An argument injection issue exists in the git show tool. The rev parameter is passed unvalidated into the git show argument vector without an --end-of-options sentinel, allowing a value starting with --output= to be interpreted as a git flag. Since the tool is auto-approved and considered read-only, an attacker using a malicious repository and prompt injection can perform an unprompted arbitrary file write with the privileges of the invoking user, potentially targeting files like ~/.ssh/authorized keys, ~/.bashrc, or ~/.gitconfig.

Recommendations Update CodeWhale to version 0.8.64.