{"id":"EUVD-2026-60970","enisaUuid":"1e9b1124-69d9-3a1e-b26b-d566410f10a3","description":"CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents\u003d/path/to/file to exfiltrate sensitive files such as SSH keys and credentials through the tool output returned to the model.","datePublished":"Aug 18, 2026, 3:22:00 PM","dateUpdated":"Aug 19, 2026, 2:38:38 PM","baseScore":8.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","references":"https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-c6mw-8xh8-gpq6\nhttps://github.com/Hmbown/CodeWhale/commit/9a34b5034d29f05d1f28fa61b04719ca6a741020\nhttps://www.vulncheck.com/advisories/codewhale-before-argument-injection-via-git-blame\n","aliases":"CVE-2026-75912\nGHSA-c6mw-8xh8-gpq6\n","assigner":"VulnCheck","epss":0.45,"enisaIdProduct":[{"id":"58016972-5b1f-366e-926f-51cd68135bd1","product":{"name":"CodeWhale","vendor":{"name":"Hmbown"}},"product_version":"0.8.41 \u003c0.8.64"},{"id":"64afa354-a138-377b-a0c6-f80c5e1a6e40","product":{"name":"CodeWhale","vendor":{"name":"Hmbown"}},"product_version":"0.3.27 \u003c0.8.41"}],"enisaIdVendor":[{"id":"d0806faa-d34d-3e0d-8336-675fc29abfa3","vendor":{"name":"Hmbown"}}],"enisaIdVulnerability":[{"id":"90e27604-b563-3a3b-adae-39142a210cbf","vulnerability":{"id":"CVE-2026-75912","description":"CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents\u003d/path/to/file to exfiltrate sensitive files such as SSH keys and credentials through the tool output returned to the model.","datePublished":"Aug 18, 2026, 3:22:00 PM","dateUpdated":"Aug 19, 2026, 2:38:38 PM","status":"PUBLISHED","baseScore":8.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","references":"https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-c6mw-8xh8-gpq6\nhttps://github.com/Hmbown/CodeWhale/commit/9a34b5034d29f05d1f28fa61b04719ca6a741020\nhttps://www.vulncheck.com/advisories/codewhale-before-argument-injection-via-git-blame\n","enisa_id":"EUVD-2026-60970\n","assigner":"VulnCheck","epss":0.45,"dataProcessed":"Nov 7, 2026, 7:19:07 AM","vulnerabilityProduct":[{"id":"672d97ca-69e4-3ad6-b07c-03877afdfe76","product":{"name":"CodeWhale","vendor":{"name":"Hmbown"}},"product_version":"0.3.27 \u003c0.8.41"},{"id":"c0d38787-f024-3e08-a1d2-e6926f56bde7","product":{"name":"CodeWhale","vendor":{"name":"Hmbown"}},"product_version":"0.8.41 \u003c0.8.64"}],"vulnerabilityVendor":[{"id":"f25968ff-e7e6-3802-980c-40289015ea72","vendor":{"name":"Hmbown"}}]}},{"id":"a13c250b-25de-3e5a-9fc0-8e7a94078117","vulnerability":{"id":"GHSA-c6mw-8xh8-gpq6","description":"CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval","datePublished":"Sep 4, 2026, 6:11:45 PM","dateUpdated":"Sep 4, 2026, 6:11:45 PM","baseScore":0.0,"references":"https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-c6mw-8xh8-gpq6\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-75912\nhttps://github.com/Hmbown/CodeWhale/commit/9a34b5034d29f05d1f28fa61b04719ca6a741020\nhttps://github.com/Hmbown/CodeWhale\nhttps://www.vulncheck.com/advisories/codewhale-before-argument-injection-via-git-blame\n","enisa_id":"EUVD-2026-60970\n","aliases":"GHSA-c6mw-8xh8-gpq6\nCVE-2026-75912\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:05:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}