Description

CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without user approval.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T16:18:23.840Z",
  "pubdate": "2026-08-18T16:18:23.840Z",
  "executiveSummary": "CodeWhale versions prior to 0.8.64 are affected by a path traversal vulnerability residing within the image_analyze tool. The core issue stems from the application's failure to properly canonicalize symbolic links prior to reading file contents. This security flaw enables unauthorized attackers to construct malicious workspace symlinks that point directly to sensitive external files possessing valid image extensions. By leveraging this mechanism, an adversary can successfully bypass standard workspace boundaries and exfiltrate arbitrary file bytes directly to the vision endpoint without requiring explicit user approval or interaction. The realization of this vulnerability presents severe risk implications, including the unauthorized disclosure of confidential system data and sensitive information stored outside the designated operational workspace. Exploitation conditions require the attacker to have the capability to create symlinks within the workspace environment, subsequently tricking the image_analyze tool into processing the targeted external resources during normal operation.",
  "technicalDetails": "The vulnerability is localized within the image_analyze tool of CodeWhale across all versions prior to 0.8.64. The root cause of the flaw is inadequate input validation and path resolution logic, specifically the omission of proper symlink canonicalization before file read operations are executed. When the image_analyze tool processes requested image inputs, it attempts to read the specified file paths relative to or referenced by the workspace without resolving the ultimate target of any underlying symbolic links. Consequently, if a symbolic link is placed inside the workspace pointing to an arbitrary file on the underlying host filesystem—provided the target file possesses an accepted image extension—the application processes the symlink and reads the linked external file. The step-by-step attack flow begins with the adversary establishing a malicious symbolic link within the workspace directory, configured to point to a sensitive system file or out-of-bounds asset. Next, the attacker invokes the image_analyze tool referencing this workspace symlink. The vulnerable component fails to validate the canonical path of the resolved target, blindly reads the raw bytes of the external file, and transmits the resulting data directly to the vision endpoint. This behavior results in the unauthorized disclosure of file bytes, effectively leaking restricted data to the processing endpoint. The exploitation vector requires local or workspace-level access to plant the symlink, but bypasses all intended authorization mechanisms, user approvals, and boundary restrictions inherent to the image_analyze functionality."
}