{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/codewhale--0.8.41--0.8.64/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.3,"id":"CVE-2026-75913"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["codewhale (\u003e= 0.8.41, \u003c 0.8.64)","codewhale-tui (\u003e= 0.8.41, \u003c 0.8.64)","CodeWhale (\u003c 0.8.64)","CodeWhale (0.8)"],"_cs_severities":["high"],"_cs_tags":["remote-code-execution","configuration-vulnerability","developer-tools","vulnerability","code-execution","authorization-bypass"],"_cs_type":"advisory","_cs_vendors":["CodeWhale"],"content_html":"\u003cp\u003eCodeWhale and codewhale-tui versions 0.8.41 through 0.8.63 contain an argument injection vulnerability within the \u003ccode\u003egit_show\u003c/code\u003e tool, assigned as CVE-2026-75913. The vulnerability stems from the tool failing to properly validate the \u003ccode\u003erev\u003c/code\u003e parameter before passing it to the \u003ccode\u003egit show\u003c/code\u003e command line. By supplying an input starting with \u003ccode\u003e--output=\u003c/code\u003e, an attacker can inject malicious flags into the git execution process. Because the tool is registered for auto-approval and marketed as a read-only utility, it is often trusted by users and automated workflows. An attacker can leverage this trust, potentially in combination with prompt injection within a malicious repository, to cause the \u003ccode\u003egit\u003c/code\u003e binary to overwrite sensitive files such as \u003ccode\u003e~/.ssh/authorized_keys\u003c/code\u003e, \u003ccode\u003e~/.bashrc\u003c/code\u003e, or \u003ccode\u003e~/.gitconfig\u003c/code\u003e with attacker-controlled content. This flaw allows for lateral movement, persistence, or credential harvesting at the privilege level of the user executing the tool. The issue is resolved in version 0.8.64 by implementing input validation for the \u003ccode\u003erev\u003c/code\u003e parameter.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary file writes, enabling an attacker to gain persistence or modify system configurations on the host machine. This poses a significant risk to developers and automated CI/CD environments where CodeWhale is utilized, potentially leading to unauthorized access to developer environments or the execution of malicious commands via modified shell profiles.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all instances of \u003ccode\u003ecodewhale\u003c/code\u003e and \u003ccode\u003ecodewhale-tui\u003c/code\u003e to version 0.8.64 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit logs for the execution of \u003ccode\u003egit\u003c/code\u003e commands spawned by CodeWhale to identify anomalous command-line arguments, specifically those containing \u003ccode\u003e--output=\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eRestrict the permissions of users executing the CodeWhale tool to limit the potential impact of an arbitrary file write on sensitive user-specific configuration files.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-18T18:55:48Z","date_published":"2026-08-18T16:55:25Z","id":"https://feed.craftedsignal.io/briefs/2026-08-codewhale-argument-injection/","summary":"An argument injection vulnerability (CVE-2026-75913) in the CodeWhale git_show tool allows attackers to perform arbitrary file writes under the user's privilege level by manipulating the 'rev' parameter.","title":"Argument Injection Vulnerability in CodeWhale git_show Tool","url":"https://feed.craftedsignal.io/briefs/2026-08-codewhale-argument-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Codewhale (\u003e= 0.8.41, \u003c 0.8.64)","version":"https://jsonfeed.org/version/1.1"}