Description

CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and injected into the AI system prompt for exfiltration.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T16:18:21.787Z",
  "pubdate": "2026-08-18T16:18:21.787Z",
  "executiveSummary": "CodeWhale versions prior to 0.8.64 are susceptible to an arbitrary file read vulnerability caused by insufficient input validation within the project configuration instructions field. This flaw enables threat actors to read arbitrary files from the victim's underlying operating system.\nThe vulnerability manifests when a victim clones a malicious repository containing a specially crafted .codewhale/config.toml file. This configuration file leverages path traversal sequences within the instructions field to target sensitive system files located outside the designated workspace boundaries.\nOnce the targeted files are read by the application, their contents are subsequently injected directly into the AI system prompt, facilitating data exfiltration through AI interactions or telemetry channels. The risk implication is severe confidentiality loss, potentially exposing sensitive credentials, configuration data, or private user files accessible to the security context of the running CodeWhale process.\nExploitation requires the victim to clone and open a malicious repository utilizing a vulnerable version of CodeWhale, establishing a local threat vector where user interaction in the form of repository cloning is necessary to trigger the automated parsing of the malicious configuration file.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of robust path normalization and validation checks within the configuration parser of CodeWhale. Specifically, the component responsible for processing the project config instructions field fails to sanitize input paths, allowing relative path traversal sequences (such as ../) to bypass workspace confinement.\nThe vulnerable component is the configuration ingestion module of CodeWhale, specifically affecting versions before 0.8.64. The flaw resides in how the application reads file paths specified inside the .codewhale/config.toml file without enforcing strict boundary constraints against directory traversal.\nThe attack flow proceeds as follows: First, an attacker crafts a malicious repository containing a .codewhale/config.toml file where the instructions configuration parameter is explicitly modified to include arbitrary path traversal strings pointing to sensitive system files, such as /etc/passwd or private SSH keys. Second, the victim clones and opens the repository using a vulnerable instance of CodeWhale. Third, upon initialization, CodeWhale automatically parses the .codewhale/config.toml file and processes the malicious instructions field. Fourth, because input validation is absent, the application reads the contents of the target file located outside the workspace. Finally, the contents of the read file are injected into the AI system prompt, allowing the attacker to exfiltrate the sensitive data via subsequent model outputs or automated telemetry.\nRegarding authentication and privileges, the exploit executes within the security context of the local user running CodeWhale, requiring no specialized authentication or elevated privileges beyond the filesystem permissions granted to the user process. The attack vector is local, driven by repository cloning, and does not require direct network exposure for the initial file read phase."
}