Executive brief
CodeWhale is an AI coding assistant tool that processes project configuration files to customize its behavior. A malicious project config file (`.codewhale/config.toml`) in a cloned repository can specify arbitrary file paths that are read from the user's system and injected into the AI model's system prompt. An attacker can exfiltrate sensitive files like SSH keys, cloud credentials, and environment secrets by crafting instructions to read files outside the workspace directory.
Technical details
The vulnerability is a path traversal / arbitrary file read in CodeWhale's project configuration merge function. The `instructions` field in `.codewhale/config.toml` or `.deepseek/config.toml` accepts an array of file paths that are expanded (converting `~` to home directory and resolving environment variables) without any workspace boundary validation. These paths are then read via `std::fs::read_to_string()` and injected directly into the AI model's system prompt via XML tags. The vulnerable code path flows from `merge_project_config()` → `instructions_paths()` → `render_instructions_block()` → `read_to_string()`. While other sensitive config keys like `api_key` and `mcp_config_path` are in a `DENY_AT_PROJECT_SCOPE` list to prevent override from project-level configs, the `instructions` field was not restricted. The fix (version 0.8.64+) adds `instructions` to the deny list or validates that all instruction paths stay within the workspace directory.
Affected products
- CodeWhale codewhale >= 0.8.41, < 0.8.64
- CodeWhale codewhale-tui >= 0.8.41, < 0.8.64
- CodeWhale deepseek-tui >= 0.8.8, < 0.8.41
Timeline
- 2026-07-16: disclosed: Vulnerability published on GitHub Advisory Database
- 2026-09-04: patched: Fix released in version 0.8.64 (commit 43563356b98c6b993085554da82e77370160a31c)
- 2026-09-04: advisory: CVE-2026-75859 assigned