---
id: CVE-2026-75915
title: >-
  CodeWhale versions before 0.8.64 contain an environment variable exposure
  vulnerability in the js_execution tool that fails to scrub parent process
  environment variables before spawning Node.js
summary: >-
  CodeWhale versions before 0.8.64 contain an environment variable exposure
  vulnerability in the js_execution tool that fails to scrub parent process
  environment variables before spawning Node.js. Attackers can craft malicious
  JavaScript c…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-200
  - CWE-526
vendor: deepseek-tui
product: deepseek-tui
affected:
  - 'deepseek-tui >= 0.8.32, <= 0.8.41'
  - 'deepseek-tui >= 0.8.32, < 0.8.41'
  - 'codewhale-tui >= 0.8.41, < 0.8.64'
  - 'codewhale >= 0.8.41, < 0.8.64'
patched:
  - deepseek-tui 0.8.41
  - codewhale-tui 0.8.64
  - codewhale 0.8.64
published: '2026-08-18'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:32:39.347'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75915'
references:
  - url: >-
      https://github.com/Hmbown/CodeWhale/commit/26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-h539-c7r8-3xq4
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/codewhale-before-environment-variable-leak-via-js-execution
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-h539-c7r8-3xq4
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75915'
  - url: 'https://github.com/advisories/GHSA-h539-c7r8-3xq4'
tags:
  - nvd
  - ghsa
  - rust
epss: 0.00678
epssPercentile: 0.50199
aliases:
  - GHSA-h539-c7r8-3xq4
ecosystem: rust
ingestedAt: '2026-09-04T18:25:57.112Z'
---

## Overview

CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API keys, cloud credentials, and authentication tokens back to the model context.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-75915)

Affected packages:

- `deepseek-tui >= 0.8.32, <= 0.8.41`
- `deepseek-tui >= 0.8.32, < 0.8.41`
- `codewhale-tui >= 0.8.41, < 0.8.64`
- `codewhale >= 0.8.41, < 0.8.64`

Patched in:

- `deepseek-tui 0.8.41`
- `codewhale-tui 0.8.64`
- `codewhale 0.8.64`

Source: https://github.com/advisories/GHSA-h539-c7r8-3xq4