---
id: CVE-2026-75914
title: >-
  CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the
  image_analyze tool that fails to canonicalize symlinks before reading files
summary: >-
  CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the
  image_analyze tool that fails to canonicalize symlinks before reading files.
  Attackers can create workspace symlinks pointing to external files with image
  ext…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-22
  - CWE-59
vendor: deepseek-tui
product: deepseek-tui
affected:
  - 'deepseek-tui >= 0.8.32, <= 0.8.41'
  - 'deepseek-tui >= 0.8.32, < 0.8.41'
  - 'codewhale-tui >= 0.8.41, < 0.8.64'
  - 'codewhale >= 0.8.41, < 0.8.64'
patched:
  - deepseek-tui 0.8.41
  - codewhale-tui 0.8.64
  - codewhale 0.8.64
published: '2026-08-18'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:32:39.347'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75914'
references:
  - url: >-
      https://github.com/Hmbown/CodeWhale/commit/26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-w7wx-5q49-r59w
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/codewhale-before-path-traversal-via-image-analyze-symlink
    label: disclosure@vulncheck.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75914'
  - url: 'https://github.com/advisories/GHSA-w7wx-5q49-r59w'
tags:
  - nvd
  - ghsa
  - rust
epss: 0.0053
epssPercentile: 0.42296
aliases:
  - GHSA-w7wx-5q49-r59w
ecosystem: rust
ingestedAt: '2026-09-04T18:25:57.305Z'
---

## Overview

CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without user approval.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-75914)

Affected packages:

- `deepseek-tui >= 0.8.32, <= 0.8.41`
- `deepseek-tui >= 0.8.32, < 0.8.41`
- `codewhale-tui >= 0.8.41, < 0.8.64`
- `codewhale >= 0.8.41, < 0.8.64`

Patched in:

- `deepseek-tui 0.8.41`
- `codewhale-tui 0.8.64`
- `codewhale 0.8.64`

Source: https://github.com/advisories/GHSA-w7wx-5q49-r59w