CVE-2026-75859 — CodeWhale before 0.8.64 Arbitrary File Read via instructions
CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malic…
Published: 2026-08-18 · CVSS: 8.7 · CVSS 4.0
CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and injected into the AI system prompt for exfiltration.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7