CodeWhale before 0.8.64 Argument Injection via git_show

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

CodeWhale versions >= 0.3.27 and < 0.8.64 (published as deepseek-tui >= 0.3.27 and < 0.8.41 on npm and 0.3.27 through 0.8.41 on crates.io, and as codewhale / codewhale-tui >= 0.8.41 and < 0.8.64) contain an argument injection vulnerability in the git_show tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted as a git flag. Because the tool is registered as auto-approved and advertised as read-only, an attacker (via a malicious repository combined with prompt injection) can cause an unprompted arbitrary file write at the privilege of the invoking user, targeting sensitive files such as ~/.ssh/authorized_keys, ~/.bashrc, or ~/.gitconfig. Fixed in codewhale / codewhale-tui 0.8.64 by adding rev validation; the deprecated deepseek-tui crate has no fixed release.

Source published

18 Aug 2026 15:22:01 UTC

Source modified

29 Oct 2026 21:16:54 UTC

Observed here

29 Oct 2026 22:48:55 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 8.5 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H

CVSS 3.1 · 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H

CodeWhale versions >= 0.3.27 and < 0.8.64 (published as deepseek-tui >= 0.3.27 and < 0.8.41 on npm and 0.3.27 through 0.8.41 on crates.io, and as codewhale / codewhale-tui >= 0.8.41 and < 0.8.64) contain an argument injection vulnerability in the git_show tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted as a git flag. Because the tool is registered as auto-approved and advertised as read-only, an attacker (via a malicious repository combined with prompt injection) can cause an unprompted arbitrary file write at the privilege of the invoking user, targeting sensitive files such as ~/.ssh/authorized_keys, ~/.bashrc, or ~/.gitconfig. Fixed in codewhale / codewhale-tui 0.8.64 by adding rev validation; the deprecated deepseek-tui crate has no fixed release.

Source published

Aug 18, 2026, 3:22:01 PM (timezone not stated)

Source modified

Oct 29, 2026, 9:16:54 PM (timezone not stated)

Observed here

5 Nov 2026 13:43:44 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 4.0 · 8.5 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H

CodeWhale versions >= 0.3.27 and < 0.8.64 (published as deepseek-tui >= 0.3.27 and < 0.8.41 on npm and 0.3.27 through 0.8.41 on crates.io, and as codewhale / codewhale-tui >= 0.8.41 and < 0.8.64) contain an argument injection vulnerability in the git_show tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted as a git flag. Because the tool is registered as auto-approved and advertised as read-only, an attacker (via a malicious repository combined with prompt injection) can cause an unprompted arbitrary file write at the privilege of the invoking user, targeting sensitive files such as ~/.ssh/authorized_keys, ~/.bashrc, or ~/.gitconfig. Fixed in codewhale / codewhale-tui 0.8.64 by adding rev validation; the deprecated deepseek-tui crate has no fixed release.

Source published

18 Aug 2026 16:18:23 UTC

Source modified

29 Oct 2026 21:17:33 UTC

Observed here

31 Oct 2026 19:04:57 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · [email protected] · Secondary · 8.5 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS 3.1 · [email protected] · Secondary · 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H

### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below. # Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Approval ## Overview The `git_show` tool in DeepSeek-TUI executes `git show` with the model-supplied `rev` parameter passed unvalidated into the argv. `git show` honours the `--output=<path>` option, so a `rev` value beginning with `--output=` is interpreted as a flag rather than a revision. The tool is registered with `ApprovalRequirement::Auto` and declares `ToolCapability::ReadOnly`, so the write happens without a user prompt and contradicts the capability the catalog advertises to the model and the user. This is the same vulnerability class as GHSA-72w5-pf8h-xfp4 (CVE-2026-45374): an auto-approved tool produces an effect outside the boundary the user consented to. ## Impact A malicious repository combined with prompt injection, the threat model already documented in CVE-2026-45311 (auto-loaded `AGENTS.md` is treated as instructions by the model) yields an unprompted arbitrary file write at the privilege of the user running DeepSeek-TUI. Useful targets reachable as the invoking user: - `~/.ssh/authorized_keys` - `~/.bashrc`, `~/.zshrc`, `~/.profile` - `~/.gitconfig` (chainable into RCE via `core.editor`) - `~/.config/**`, `~/.aws/credentials`, project source files The written content is the `git show` rendering of HEAD commit hash, author/date header, indented commit message, and (when `patch=true`) diff hunks. The commit subject, body, author identity, and diff text are entirely attacker-controlled because the attacker owns the repository HEAD. The leading `commit <hash>` line prevents clean overwrite of formats that reject unknown tokens, but is silently ignorable in files parsed as comments-or-text (crontab, dotfiles consumed by tolerant readers) and is irrelevant for the destructive/DoS sub-case (clobbering `~/.ssh/authorized_keys` locks the user out; clobbering a project file corrupts source). ## Technical Details ### Root Cause `crates/tui/src/tools/git_history.rs`: ```rust // L196-198 fn approval_requirement(&self) -> ApprovalRequirement { ApprovalRequirement::Auto } // L204-228 (excerpt) async fn execute(&self, input: Value, context: &ToolContext) -> Result<ToolResult, ToolError> { let rev = required_str(&input, "rev")?; ... let mut args = vec![ "show".to_string(), "--no-color".to_string(), "--no-ext-diff".to_string(), ]; if patch { args.push(format!("--unified={unified}")); } else { args.push("--no-patch".to_string()); } if stat { args.push("--stat".to_string()); } args.push(rev.to_string()); // unvalidated, no `--end-of-options` sentinel ... } ``` The JSON schema for `rev` is `{"type": "string"}` (L161-164) with no `pattern`, no enum, and no length cap. `required_str` performs no semantic validation. The argv has no `--end-of-options` separator between the trailing options and `rev`, so git's option parser keeps consuming flags from `rev`. The same pattern in `git_blame` (L322-388) is tracked in a separate advisory. ### Why `--output` Works `git show` shares its option parser with `git log` / `git diff`, which expose `--output=<file>`. The implementation opens the path with `O_WRONLY | O_CREAT | O_TRUNC` and writes the formatted output there. No permission check beyond the filesystem's own running as the user is sufficient to clobber anything the user owns. ## Proof of Concept The vulnerable argv assembled by the tool when invoked with `{"rev": "--output=/home/victim/.bashrc"}` is equivalent to: ``` git show --no-color --no-ext-diff --no-patch --stat --output=/home/victim/.bashrc ``` Reproduced against system `git` as a non-root user: ``` $ id uid=1001(lowtest) gid=1001(lowtest) groups=1001(lowtest) $ cd /tmp/lp && git init -q $ echo a > a.txt && git add a.txt $ git -c user.email=a@b -c user.name=a commit -q -m "lol" $ git show --no-color --no-patch "--output=/home/lowtest/.bashrc_clobbered" HEAD $ ls -la /home/lowtest/.bashrc_clobbered -rw-rw-r-- 1 lowtest lowtest 128 May 19 07:05 /home/lowtest/.bashrc_clobbered ``` End-to-end exploitation path: - Attacker publishes a repository whose `AGENTS.md` instructs the model to call `git_show` with `rev` set to a crafted `--output=` string targeting a file in the victim's home directory. The same auto-load pathway documented in CVE-2026-45311 applies. - Victim opens the repository in DeepSeek-TUI and issues any prompt that exercises the agent loop. - The model issues the tool call. Because `approval_requirement()` returns `Auto`, no approval UI is shown. - `git show --output=<path>` overwrites the target file with attacker-controlled commit metadata and diff text. ## Remediation Two changes in `crates/tui/src/tools/git_history.rs`: Insert an end-of-options sentinel before `rev` so git stops parsing flags: ```rust args.push("--end-of-options".to_string()); args.push(rev.to_string()); ``` Reject `rev` values that begin with `-` (or restrict to a revision-shape regex `^[A-Za-z0-9._/^~@:{}-]+$` after the leading character check): ```rust if rev.starts_with('-') { return Err(ToolError::invalid_input("rev must not start with '-'")); } ``` A regression test mirroring `run_tests_requires_user_approval` (`test_runner.rs:197`) should assert that `rev = "--output=/tmp/x"` is rejected.

Source published

4 Sep 2026 18:02:37 UTC

Source modified

4 Sep 2026 19:00:04 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H

Publisher rating · HIGH