Description

CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain an argument injection vulnerability in the git_show tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted as a git flag. Because the tool is registered as auto-approved and advertised as read-only, an attacker (via a malicious repository combined with prompt injection) can cause an unprompted arbitrary file write at the privilege of the invoking user, targeting sensitive files such as ~/.ssh/authorized_keys, ~/.bashrc, or ~/.gitconfig. Fixed in 0.8.64 by adding rev validation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-18T16:18:23.363Z",
  "pubdate": "2026-08-18T16:18:23.363Z",
  "executiveSummary": "CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 suffer from an argument injection vulnerability within the git_show tool.\nThe vulnerability allows an attacker via a malicious repository combined with prompt injection to achieve unprompted arbitrary file write at the privilege of the invoking user.\nThe affected product is CodeWhale, impacting systems running vulnerable versions where the git_show tool is registered as auto-approved and advertised as read-only.\nRisk implications are severe, as exploitation can target sensitive files such as ~/.ssh/authorized_keys, ~/.bashrc, or ~/.gitconfig without requiring user interaction.\nAttacker capabilities include modifying critical user configuration and authentication files by abusing improperly sanitized model-supplied parameters passed to underlying execution primitives.",
  "technicalDetails": "The root cause of the vulnerability lies in the handling of the model-supplied rev parameter within the git_show tool.\nSpecifically, the rev parameter is passed unvalidated directly into the git show argv without utilizing an --end-of-options sentinel.\nBecause of this missing sanitization and lack of option termination, a specially crafted value beginning with --output= supplied by an attacker is incorrectly interpreted by the underlying binary as a valid git flag rather than a positional revision argument.\nThe vulnerable component is the git_show tool functionality within CodeWhale versions >= 0.8.41 and < 0.8.64.\nExploitation occurs when an attacker sets up a malicious repository and leverages prompt injection techniques to force the model to pass a malicious string to the git_show tool.\nBecause the git_show tool is registered as auto-approved and incorrectly advertised as a read-only operation, the execution proceeds without prompting the user.\nThe crafted argument leverages the injected git flag to redirect output, resulting in arbitrary file write capabilities.\nThe payload behavior allows an attacker to overwrite or create sensitive files in the context of the user running the application.\nPost-exploitation impact includes the potential compromise of user accounts and environments by targeting sensitive file paths including ~/.ssh/authorized_keys, ~/.bashrc, or ~/.gitconfig."
}