{"id":"CVE-2026-75912","title":"CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter","summary":"CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values…","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","cwe":["CWE-88","CWE-200"],"vendor":"deepseek-tui","product":"deepseek-tui","affected":["deepseek-tui >= 0.3.27, <= 0.8.41","deepseek-tui >= 0.3.27, < 0.8.41","codewhale-tui >= 0.8.41, < 0.8.64","codewhale >= 0.8.41, < 0.8.64"],"patched":["deepseek-tui 0.8.41","codewhale-tui 0.8.64","codewhale 0.8.64"],"published":"2026-08-18","updated":"2026-09-08","sourceUpdated":"2026-09-08T20:32:39.347","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75912","references":[{"url":"https://github.com/Hmbown/CodeWhale/commit/9a34b5034d29f05d1f28fa61b04719ca6a741020","label":"disclosure@vulncheck.com"},{"url":"https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-c6mw-8xh8-gpq6","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/codewhale-before-argument-injection-via-git-blame","label":"disclosure@vulncheck.com"},{"url":"https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-c6mw-8xh8-gpq6","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75912"},{"url":"https://github.com/advisories/GHSA-c6mw-8xh8-gpq6"}],"tags":["nvd","ghsa","rust"],"epss":0.00408,"epssPercentile":0.34844,"aliases":["GHSA-c6mw-8xh8-gpq6"],"ecosystem":"rust","ingestedAt":"2026-09-04T18:25:57.025Z","slug":"CVE-2026-75912","body":"## Overview\n\nCodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files such as SSH keys and credentials through the tool output returned to the model.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-75912)\n\nAffected packages:\n\n- `deepseek-tui >= 0.3.27, <= 0.8.41`\n- `deepseek-tui >= 0.3.27, < 0.8.41`\n- `codewhale-tui >= 0.8.41, < 0.8.64`\n- `codewhale >= 0.8.41, < 0.8.64`\n\nPatched in:\n\n- `deepseek-tui 0.8.41`\n- `codewhale-tui 0.8.64`\n- `codewhale 0.8.64`\n\nSource: https://github.com/advisories/GHSA-c6mw-8xh8-gpq6","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":40.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}