CVE-2026-75912: CodeWhale git_blame argument injection allows arbitrary file read

Quick answers

Is CVE-2026-75912 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-75912 being exploited in the wild.

How severe is CVE-2026-75912?

High severity, with a CVSS score of 7.4, published 4 September 2026.

Which products and versions are affected?

codewhale-tui (crates.io) >= 0.8.41, < 0.8.64; deepseek-tui (crates.io) >= 0.3.27, <= 0.8.41; Hmbown CodeWhale >= 0.8.41, < 0.8.64.

Is there a fix for CVE-2026-75912?

A patch was published on 2026-09-04: Version 0.8.64 released with fix in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-75912 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-75912?

Check whether you run codewhale-tui (crates.io), deepseek-tui (crates.io) or Hmbown CodeWhale at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an argument-injection (CWE-88) in the git_blame tool's execute function (crates/tui/src/tools/git_history.rs, lines 322–358). The `path` parameter is correctly validated and bounded to the workspace via `context.resolve_path()`, but the `rev` parameter is taken directly from user input without validation and concatenated into the git command argv. The tool passes `rev` as a positional argument followed by `--`, but this does not prevent git from interpreting leading-hyphen prefixed values as options. An attacker can inject `--contents=/path/to/secret` or similar git blame options to read files outside the workspace. The tool is registered with `ApprovalRequirement::Auto`, meaning it executes without human review. Exploitation requires a malicious git repository and prompt injection to manipulate the AI model into calling git_blame with the crafted `rev` value. The fix adds `--end-of-options` delimiter before `rev` and rejects input values starting with a hyphen.

Affected products

• Hmbown CodeWhale >= 0.8.41, < 0.8.64
• DeepSeek DeepSeek-TUI >= 0.3.27, <= 0.8.41

Identifiers

• CVE-2026-75912
• GHSA-c6mw-8xh8-gpq6

Timeline

• 2026-09-04: disclosed: Advisory published on GitHub Advisory Database
• 2026-09-04: patched: Version 0.8.64 released with fix in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020

References

• https://api.github.com/users/0xEr3n
• https://github.com/0xEr3n
• https://api.github.com/users/0xEr3n/gists%7B/gist_id%7D
• https://api.github.com/users/0xEr3n/repos
• https://avatars.githubusercontent.com/u/98734964?v=4
• https://api.github.com/users/0xEr3n/events%7B/privacy%7D