High severity7.5NVD Advisory· Published Aug 18, 2026· Updated Sep 8, 2026
CVE-2026-75859
CVE-2026-75859
Description
CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and injected into the AI system prompt for exfiltration.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
deepseek-tuicrates.io | >= 0.8.8 | — |
deepseek-tuinpm | >= 0.8.8, < 0.8.41 | 0.8.41 |
codewhale-tuicrates.io | >= 0.8.41, < 0.8.64 | 0.8.64 |
codewhalenpm | >= 0.8.41, < 0.8.64 | 0.8.64 |
Affected products
2Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-62f5-cp2p-vq95ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-75859ghsaADVISORY
- github.com/Hmbown/CodeWhale/commit/43563356b98c6b993085554da82e77370160a31cnvdWEB
- github.com/Hmbown/CodeWhale/security/advisories/GHSA-62f5-cp2p-vq95nvdWEB
- www.vulncheck.com/advisories/codewhale-before-arbitrary-file-read-via-instructionsnvdWEB
News mentions
0No linked articles in our index yet.