CVE-2026-75859: CodeWhale project config instructions arbitrary file read

CVE-2026-75859 · Severity: high · CVSS 7.5 · Published 2026-09-04

CodeWhale is an AI-powered development tool that executes on a developer's local machine. A malicious project configuration file in a cloned repository can instruct CodeWhale to read arbitrary files from the developer's system (such as SSH keys or AWS credentials) and inject them into the AI model's system prompt, making them visible to the model and potentially exfiltrable through conversation. An attacker only needs to commit a malicious configuration file to a repository; the victim's interaction is simply running CodeWhale in that repository directory.

Technologies: codewhale-tui (crates.io), deepseek-tui (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2026-75859 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-75859 being exploited in the wild.
How severe is CVE-2026-75859?
High severity, with a CVSS score of 7.5, published 4 September 2026.
Which products and versions are affected?
codewhale-tui (crates.io) >= 0.8.41, < 0.8.64; deepseek-tui (crates.io) >= 0.8.8, < 0.8.41.
Is there a fix for CVE-2026-75859?
A patch was published on 2026-06-21: Fix released in version 0.8.64 (commit 43563356b98c6b993085554da82e77370160a31c) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-75859 attacked?
It is attacked over the network.
Am I affected by CVE-2026-75859?
Check whether you run codewhale-tui (crates.io) or deepseek-tui (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in CodeWhale's project configuration merge logic, which reads an `instructions` array from a `.codewhale/config.toml` or `.deepseek/config.toml` file in a cloned repository without path validation or workspace boundary checks. The code calls `expand_path()` to resolve tilde (`~`) to the user's home directory and environment variables, then passes these file paths directly to `std::fs::read_to_string()` at prompt-render time. The file contents are subsequently injected into the AI model's system prompt via XML-like tags. The root cause is the absence of workspace isolation enforcement in the instructions loading path, in contrast to file tools elsewhere in the codebase that enforce `starts_with()` boundary checks. An attacker with repository write access (or via supply-chain compromise) can craft instructions pointing to sensitive files like `~/.ssh/id_rsa`, `~/.aws/credentials`, or `.env` files, all of which are well under the 100KB per-file limit. The fix in version 0.8.64 (commit 4356335) prevents project-scoped configuration from loosening security policy, including the instructions field.

Affected products

  • CodeWhale CodeWhale >=0.8.41, <0.8.64
  • CodeWhale codewhale-tui >=0.8.41, <0.8.64
  • CodeWhale deepseek-tui >=0.8.8, <0.8.41

Identifiers

  • CVE-2026-75859
  • GHSA-62f5-cp2p-vq95

Timeline

  • 2026-09-04: disclosed: Advisory GHSA-62f5-cp2p-vq95 published
  • 2026-06-21: patched: Fix released in version 0.8.64 (commit 43563356b98c6b993085554da82e77370160a31c)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.