# CVE-2026-75914: CodeWhale image_analyze symlink path traversal in vision tool

Source: https://junglewise.ai/threats/cve-2026-75914-codewhale-image-analyze-symlink-path-traversal-in-vision-tool  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75914 · Severity: high · CVSS 7.5 · Published 2026-09-04

CodeWhale's image_analyze tool, used to analyze images in AI workflows, fails to properly restrict file access to the workspace boundary. An attacker can create a symlink with an image extension name pointing to sensitive files outside the workspace. The tool automatically processes this symlink without user approval and sends the file contents base64-encoded to the configured vision API endpoint, exposing arbitrary file bytes to the vision provider and any network intermediary.

Technologies: [codewhale-tui (crates.io)](https://junglewise.ai/threats/technologies/codewhale-tui), [deepseek-tui (crates.io)](https://junglewise.ai/threats/technologies/deepseek-tui). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is CVE-2026-75914 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75914 being exploited in the wild.

**How severe is CVE-2026-75914?** High severity, with a CVSS score of 7.5, published 4 September 2026.

**Which products and versions are affected?** codewhale-tui (crates.io) >= 0.8.41, < 0.8.64; deepseek-tui (crates.io) >= 0.8.32, <= 0.8.41.

**Is there a fix for CVE-2026-75914?** A patch was published on 2026-07-16: Fix released in version 0.8.64 (commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75914 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-75914?** Check whether you run codewhale-tui (crates.io) or deepseek-tui (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a path traversal via symlink in the image_analyze tool (crates/tui/src/vision/tools.rs). The tool performs a lexical check to reject absolute paths and parent-dir components but does not canonicalize the path, so it fails to detect symlinks that bypass the checks. When a symlink like "workspace/screenshot.png → /etc/passwd" is provided, the lexical check passes (components are [Normal("screenshot.png")]), but the subsequent tokio::fs::read() call follows the symlink to the target file. The file contents are then base64-encoded and embedded in a chat-completion request POSTed to the vision endpoint with the user's authorization token. The tool declares ReadOnly capability and relies on the trait default approval_requirement(), which resolves to Auto, allowing the model to invoke it without user prompts. Other file-reading tools in the same codebase use the central ToolContext::resolve_path() method, which canonicalizes paths and properly rejects symlinks escaping the workspace. The fix is a one-line change to use resolve_path() instead of context.workspace.join(). Patched in version 0.8.64.

## Affected products

- CodeWhale codewhale >=0.8.41, <0.8.64
- CodeWhale codewhale-tui >=0.8.41, <0.8.64
- CodeWhale deepseek-tui >=0.8.32, <=0.8.41

## Identifiers

- CVE-2026-75914
- GHSA-w7wx-5q49-r59w

## Timeline

- 2026-09-04: disclosed: Vulnerability advisory published
- 2026-07-16: patched: Fix released in version 0.8.64 (commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e)
- 2026-05-12: other: Earlier incomplete fix (commit 2326220) attempted to address Windows paths but missed the fundamental symlink canonicalization issue

## References

- [https://api.github.com/users/fg0x0](https://api.github.com/users/fg0x0)
- [https://github.com/fg0x0](https://github.com/fg0x0)
- [https://api.github.com/users/fg0x0/gists%7B/gist_id%7D](https://api.github.com/users/fg0x0/gists%7B/gist_id%7D)
- [https://api.github.com/users/fg0x0/repos](https://api.github.com/users/fg0x0/repos)
- [https://avatars.githubusercontent.com/u/35772301?v=4](https://avatars.githubusercontent.com/u/35772301?v=4)
- [https://api.github.com/users/fg0x0/events%7B/privacy%7D](https://api.github.com/users/fg0x0/events%7B/privacy%7D)

## Related threats

- [CodeWhale project config allow_shell override enables arbitrary shell execution](https://junglewise.ai/threats/cve-2026-75911-codewhale-project-config-allow-shell-override-enables-arbitrary)
- [CodeWhale rlm_eval approval bypass code execution](https://junglewise.ai/threats/cve-2026-75858-codewhale-rlm-eval-approval-bypass-code-execution)
- [CodeWhale git_blame argument injection allows arbitrary file read](https://junglewise.ai/threats/cve-2026-75912-codewhale-git-blame-argument-injection-allows-arbitrary-file-read)
- [CodeWhale SSRF bypass via TOCTOU in DNS pinning](https://junglewise.ai/threats/cve-2026-75856-codewhale-ssrf-bypass-via-toctou-in-dns-pinning)
- [CodeWhale js_execution environment variable disclosure](https://junglewise.ai/threats/cve-2026-75915-codewhale-js-execution-environment-variable-disclosure)