PT-2026-77166

CVE-2026-75915

Published

2026-08-18

Updated

2026-09-04

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CodeWhale versions prior to 0.8.64

Description The js execution tool fails to scrub parent process environment variables before spawning Node.js. This allows attackers to execute malicious JavaScript code that reads process.env to leak sensitive information, such as API keys, cloud credentials, and authentication tokens, back to the model context.

Recommendations Update CodeWhale to version 0.8.64 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Fg0X0

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable