Executive brief
CodeWhale is a TUI tool that integrates git operations with AI models. Its `git_blame` command is intended to read and analyze files only within a project workspace, but an argument-injection flaw allows an attacker to craft a malicious repository that tricks the AI into calling `git_blame` with a specially crafted revision parameter that reads arbitrary files on the user's system—such as SSH keys, AWS credentials, or environment files—and exposes them in the chat transcript.
Technical details
The vulnerability is an argument-injection (CWE-88) in the git_blame tool's execute function (crates/tui/src/tools/git_history.rs, lines 322–358). The `path` parameter is correctly validated and bounded to the workspace via `context.resolve_path()`, but the `rev` parameter is taken directly from user input without validation and concatenated into the git command argv. The tool passes `rev` as a positional argument followed by `--`, but this does not prevent git from interpreting leading-hyphen prefixed values as options. An attacker can inject `--contents=/path/to/secret` or similar git blame options to read files outside the workspace. The tool is registered with `ApprovalRequirement::Auto`, meaning it executes without human review. Exploitation requires a malicious git repository and prompt injection to manipulate the AI model into calling git_blame with the crafted `rev` value. The fix adds `--end-of-options` delimiter before `rev` and rejects input values starting with a hyphen.
Affected products
- Hmbown CodeWhale >= 0.8.41, < 0.8.64
- DeepSeek DeepSeek-TUI >= 0.3.27, <= 0.8.41
Timeline
- 2026-09-04: disclosed: Advisory published on GitHub Advisory Database
- 2026-09-04: patched: Version 0.8.64 released with fix in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020