Description

CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files such as SSH keys and credentials through the tool output returned to the model.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-18T16:18:23.220Z",
  "pubdate": "2026-08-18T16:18:23.220Z",
  "executiveSummary": "An argument injection vulnerability exists in CodeWhale versions before 0.8.64 within the git_blame tool. The flaw allows remote attackers to read arbitrary files from the underlying filesystem by injecting malicious command-line options into the unvalidated rev parameter. This security defect introduces severe risks of sensitive data exfiltration, including the unauthorized disclosure of private SSH keys, system credentials, and configuration secrets. The vulnerability impacts all deployments of the CodeWhale product running vulnerable versions prior to 0.8.64. Attackers capable of interacting with the model and supplying input to the affected tool can leverage this flaw without complex pre-existing privileges, resulting in direct confidentiality breaches as file contents are returned via the model output.",
  "technicalDetails": "The root cause of the vulnerability resides in the insecure handling and lack of input sanitization within the git_blame tool component of CodeWhale versions before 0.8.64. Specifically, the rev parameter accepts user-supplied input and passes it directly to underlying Git operations without proper validation, filtering, or encapsulation as explicit positional arguments.\nBecause the input is unsanitized, an attacker can supply specially crafted Git command-line flags and options disguised as revision specifiers. By injecting options such as --contents=/path/to/file, the attacker manipulates the execution context of the underlying git blame command. This forces the utility to evaluate arbitrary files on the host filesystem instead of operating strictly on repository revisions.\nThe step-by-step attack flow begins when an untrusted user interacts with the model, prompting the execution of the git_blame tool with a malicious payload supplied in the rev parameter. The vulnerable application constructs the command string or argument array incorporating the unvalidated input and executes the git blame process. Due to the lack of argument separation or blocklisting, the Git binary parses the injected option flags. The utility reads the targeted sensitive file specified in the argument, such as an SSH key or credential store, and incorporates its contents into the standard output stream. Finally, the tool captures this output and returns it directly to the model, effectively exfiltrating the sensitive data back to the attacker.\nThe affected component is the git_blame tool implementation handling the rev parameter in CodeWhale prior to version 0.8.64. Exploitation relies on the direct processing of user input by the command execution layer, bypassing expected input constraints."
}