CVE-2026-75915: CodeWhale js_execution environment variable disclosure

CVE-2026-75915 · Severity: high · CVSS 7.5 · Published 2026-09-04

CodeWhale's JavaScript execution tool fails to sanitize environment variables before spawning Node.js, allowing the model to read and exfiltrate sensitive credentials (API keys, cloud secrets, tokens) that are exported in the user's shell. In automatic-approval mode, adversarial prompts can leak these credentials without user interaction.

Technologies: codewhale-tui (crates.io), deepseek-tui (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2026-75915 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-75915 being exploited in the wild.
How severe is CVE-2026-75915?
High severity, with a CVSS score of 7.5, published 4 September 2026.
Which products and versions are affected?
codewhale-tui (crates.io) >= 0.8.41, < 0.8.64; deepseek-tui (crates.io) >= 0.8.32, <= 0.8.41.
Is there a fix for CVE-2026-75915?
A patch was published on 2026-09-04: Fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e; users should upgrade to 0.8.64 or later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-75915 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-75915?
Check whether you run codewhale-tui (crates.io) or deepseek-tui (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The js_execution tool spawns a Node.js subprocess using tokio::process::Command::new without invoking the project's child_env scrubber (apply_to_tokio_command), which is correctly applied by exec_shell, the Python REPL, and the MCP launcher. The subprocess inherits the complete parent process environment, and the tool's stdout (which includes output from model-provided JavaScript reading process.env) flows directly back into the model's context and transcript. An attacker can craft a prompt injection (via a fetched README, web page, or MCP server output) that causes the model to invoke js_execution with code that exfiltrates all environment variables. In YOLO mode (auto_approve=true), this happens without any user approval. The fix is a one-line addition: calling apply_to_tokio_command with an empty argument list to enable environment variable filtering, which drops credentials and retains only whitelisted benign variables (PATH, HOME, LANG, TMPDIR, proxy settings).

Affected products

  • CodeWhale codewhale >=0.8.41, <0.8.64
  • CodeWhale codewhale-tui >=0.8.41, <0.8.64
  • CodeWhale deepseek-tui >=0.8.32, <=0.8.41

Identifiers

  • CVE-2026-75915
  • GHSA-h539-c7r8-3xq4

Timeline

  • 2026-09-04: disclosed: Advisory published
  • 2026-09-04: patched: Fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e; users should upgrade to 0.8.64 or later

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.