# CVE-2026-75915: CodeWhale js_execution environment variable disclosure

Source: https://junglewise.ai/threats/cve-2026-75915-codewhale-js-execution-environment-variable-disclosure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75915 · Severity: high · CVSS 7.5 · Published 2026-09-04

CodeWhale's JavaScript execution tool fails to sanitize environment variables before spawning Node.js, allowing the model to read and exfiltrate sensitive credentials (API keys, cloud secrets, tokens) that are exported in the user's shell. In automatic-approval mode, adversarial prompts can leak these credentials without user interaction.

Technologies: [codewhale-tui (crates.io)](https://junglewise.ai/threats/technologies/codewhale-tui), [deepseek-tui (crates.io)](https://junglewise.ai/threats/technologies/deepseek-tui). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is CVE-2026-75915 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75915 being exploited in the wild.

**How severe is CVE-2026-75915?** High severity, with a CVSS score of 7.5, published 4 September 2026.

**Which products and versions are affected?** codewhale-tui (crates.io) >= 0.8.41, < 0.8.64; deepseek-tui (crates.io) >= 0.8.32, <= 0.8.41.

**Is there a fix for CVE-2026-75915?** A patch was published on 2026-09-04: Fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e; users should upgrade to 0.8.64 or later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75915 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-75915?** Check whether you run codewhale-tui (crates.io) or deepseek-tui (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The js_execution tool spawns a Node.js subprocess using tokio::process::Command::new without invoking the project's child_env scrubber (apply_to_tokio_command), which is correctly applied by exec_shell, the Python REPL, and the MCP launcher. The subprocess inherits the complete parent process environment, and the tool's stdout (which includes output from model-provided JavaScript reading process.env) flows directly back into the model's context and transcript. An attacker can craft a prompt injection (via a fetched README, web page, or MCP server output) that causes the model to invoke js_execution with code that exfiltrates all environment variables. In YOLO mode (auto_approve=true), this happens without any user approval. The fix is a one-line addition: calling apply_to_tokio_command with an empty argument list to enable environment variable filtering, which drops credentials and retains only whitelisted benign variables (PATH, HOME, LANG, TMPDIR, proxy settings).

## Affected products

- CodeWhale codewhale >=0.8.41, <0.8.64
- CodeWhale codewhale-tui >=0.8.41, <0.8.64
- CodeWhale deepseek-tui >=0.8.32, <=0.8.41

## Identifiers

- CVE-2026-75915
- GHSA-h539-c7r8-3xq4

## Timeline

- 2026-09-04: disclosed: Advisory published
- 2026-09-04: patched: Fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e; users should upgrade to 0.8.64 or later

## References

- [https://api.github.com/users/fg0x0](https://api.github.com/users/fg0x0)
- [https://github.com/fg0x0](https://github.com/fg0x0)
- [https://api.github.com/users/fg0x0/gists%7B/gist_id%7D](https://api.github.com/users/fg0x0/gists%7B/gist_id%7D)
- [https://api.github.com/users/fg0x0/repos](https://api.github.com/users/fg0x0/repos)
- [https://avatars.githubusercontent.com/u/35772301?v=4](https://avatars.githubusercontent.com/u/35772301?v=4)
- [https://api.github.com/users/fg0x0/events%7B/privacy%7D](https://api.github.com/users/fg0x0/events%7B/privacy%7D)

## Related threats

- [CodeWhale project config allow_shell override enables arbitrary shell execution](https://junglewise.ai/threats/cve-2026-75911-codewhale-project-config-allow-shell-override-enables-arbitrary)
- [CodeWhale rlm_eval approval bypass code execution](https://junglewise.ai/threats/cve-2026-75858-codewhale-rlm-eval-approval-bypass-code-execution)
- [CodeWhale git_blame argument injection allows arbitrary file read](https://junglewise.ai/threats/cve-2026-75912-codewhale-git-blame-argument-injection-allows-arbitrary-file-read)
- [CodeWhale SSRF bypass via TOCTOU in DNS pinning](https://junglewise.ai/threats/cve-2026-75856-codewhale-ssrf-bypass-via-toctou-in-dns-pinning)
- [CodeWhale project config instructions arbitrary file read](https://junglewise.ai/threats/cve-2026-75859-codewhale-project-config-instructions-arbitrary-file-read)