# CVE-2026-75912: CodeWhale git_blame argument injection allows arbitrary file read

Source: https://junglewise.ai/threats/cve-2026-75912-codewhale-git-blame-argument-injection-allows-arbitrary-file-read  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75912 · Severity: high · CVSS 7.4 · Published 2026-09-04

CodeWhale is a TUI tool that integrates git operations with AI models. Its `git_blame` command is intended to read and analyze files only within a project workspace, but an argument-injection flaw allows an attacker to craft a malicious repository that tricks the AI into calling `git_blame` with a specially crafted revision parameter that reads arbitrary files on the user's system—such as SSH keys, AWS credentials, or environment files—and exposes them in the chat transcript.

Technologies: [codewhale-tui (crates.io)](https://junglewise.ai/threats/technologies/codewhale-tui), [deepseek-tui (crates.io)](https://junglewise.ai/threats/technologies/deepseek-tui), [Hmbown CodeWhale](https://junglewise.ai/threats/technologies/codewhale). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [Hmbown](https://junglewise.ai/threats/vendors/hmbown).

## Quick answers

**Is CVE-2026-75912 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75912 being exploited in the wild.

**How severe is CVE-2026-75912?** High severity, with a CVSS score of 7.4, published 4 September 2026.

**Which products and versions are affected?** codewhale-tui (crates.io) >= 0.8.41, < 0.8.64; deepseek-tui (crates.io) >= 0.3.27, <= 0.8.41; Hmbown CodeWhale >= 0.8.41, < 0.8.64.

**Is there a fix for CVE-2026-75912?** A patch was published on 2026-09-04: Version 0.8.64 released with fix in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75912 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-75912?** Check whether you run codewhale-tui (crates.io), deepseek-tui (crates.io) or Hmbown CodeWhale at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an argument-injection (CWE-88) in the git_blame tool's execute function (crates/tui/src/tools/git_history.rs, lines 322–358). The `path` parameter is correctly validated and bounded to the workspace via `context.resolve_path()`, but the `rev` parameter is taken directly from user input without validation and concatenated into the git command argv. The tool passes `rev` as a positional argument followed by `--`, but this does not prevent git from interpreting leading-hyphen prefixed values as options. An attacker can inject `--contents=/path/to/secret` or similar git blame options to read files outside the workspace. The tool is registered with `ApprovalRequirement::Auto`, meaning it executes without human review. Exploitation requires a malicious git repository and prompt injection to manipulate the AI model into calling git_blame with the crafted `rev` value. The fix adds `--end-of-options` delimiter before `rev` and rejects input values starting with a hyphen.

## Affected products

- Hmbown CodeWhale >= 0.8.41, < 0.8.64
- DeepSeek DeepSeek-TUI >= 0.3.27, <= 0.8.41

## Identifiers

- CVE-2026-75912
- GHSA-c6mw-8xh8-gpq6

## Timeline

- 2026-09-04: disclosed: Advisory published on GitHub Advisory Database
- 2026-09-04: patched: Version 0.8.64 released with fix in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020

## References

- [https://api.github.com/users/0xEr3n](https://api.github.com/users/0xEr3n)
- [https://github.com/0xEr3n](https://github.com/0xEr3n)
- [https://api.github.com/users/0xEr3n/gists%7B/gist_id%7D](https://api.github.com/users/0xEr3n/gists%7B/gist_id%7D)
- [https://api.github.com/users/0xEr3n/repos](https://api.github.com/users/0xEr3n/repos)
- [https://avatars.githubusercontent.com/u/98734964?v=4](https://avatars.githubusercontent.com/u/98734964?v=4)
- [https://api.github.com/users/0xEr3n/events%7B/privacy%7D](https://api.github.com/users/0xEr3n/events%7B/privacy%7D)

## Related threats

- [CodeWhale project config allow_shell override enables arbitrary shell execution](https://junglewise.ai/threats/cve-2026-75911-codewhale-project-config-allow-shell-override-enables-arbitrary)
- [CodeWhale rlm_eval approval bypass code execution](https://junglewise.ai/threats/cve-2026-75858-codewhale-rlm-eval-approval-bypass-code-execution)
- [CodeWhale SSRF bypass via TOCTOU in DNS pinning](https://junglewise.ai/threats/cve-2026-75856-codewhale-ssrf-bypass-via-toctou-in-dns-pinning)
- [CodeWhale js_execution environment variable disclosure](https://junglewise.ai/threats/cve-2026-75915-codewhale-js-execution-environment-variable-disclosure)
- [CodeWhale project config instructions arbitrary file read](https://junglewise.ai/threats/cve-2026-75859-codewhale-project-config-instructions-arbitrary-file-read)