CVE-2026-75859 in CodeWhale
Summary
by MITRE • 08/18/2026
CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and injected into the AI system prompt for exfiltration.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified in CodeWhale versions prior to 0.8.64 represents a critical security flaw rooted in improper input validation, specifically concerning file path handling within project configuration files. This issue falls under the category of CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as directory traversal or path traversal. The core technical failure lies in the application's inability to sanitize and validate absolute paths provided in the config instructions field before processing them. When a user clones a repository containing a malicious .codewhale/config.toml file, the software does not restrict these paths to the local workspace boundaries. Instead, it proceeds to read the specified files regardless of their location on the host system's filesystem hierarchy.
The operational impact of this vulnerability is severe due to its integration with artificial intelligence systems. The content of the arbitrary files read by CodeWhale is directly injected into the AI system prompt. This mechanism transforms a standard file reading error into a potent data exfiltration vector. An attacker can craft a configuration file that targets sensitive local resources, such as environment variables containing API keys and database credentials, private SSH or GPG keys, source code repositories with proprietary logic, or personal documents stored outside the project directory. By leveraging the AI system's processing capabilities, the vulnerability allows for the remote extraction of this confidential data without requiring direct shell access to the victim's machine.
This attack vector aligns closely with ATT&CK technique T1083: File and Directory Discovery, as it involves enumerating and accessing files on a local system. Furthermore, because the exfiltrated data is passed into an AI model, it may also relate to techniques involving indirect command execution or prompt injection if the AI subsequently acts upon the injected context in unintended ways. The severity of this flaw is amplified by its potential for supply chain compromise; since configuration files are often version-controlled and shared among team members, a single malicious commit can propagate the vulnerability across an entire development organization.
Mitigation strategies must focus on strict input validation and secure coding practices. Developers should implement allow-listing mechanisms that restrict file access exclusively to paths within the designated workspace directory. Any path traversal sequences such as ../ or absolute paths pointing outside this boundary should be rejected immediately during configuration parsing. Additionally, applying principle of least privilege ensures that even if a vulnerability is exploited, the process running CodeWhale lacks permissions to read sensitive system files. Upgrading to version 0.8.64 or later resolves this issue by implementing proper path validation checks. Organizations relying on earlier versions should isolate development environments from critical data stores and audit existing repositories for any injected malicious configuration files that could trigger this exfiltration mechanism.