CVE-2026-75915 in CodeWhale
Summary
by MITRE • 08/18/2026
CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API keys, cloud credentials, and authentication tokens back to the model context.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
CodeWhale versions prior to 0.8.64 contain a critical security flaw within its js_execution utility that results in the unintended exposure of sensitive environment variables from the parent process. This vulnerability stems from an improper handling of process inheritance during the initialization of child Node.js instances. When the tool spawns a new JavaScript execution context, it fails to explicitly scrub or filter inherited environmental data, thereby passing down all accessible variables from the invoking shell or application into the sandboxed environment intended for code evaluation.
The technical root cause lies in the default behavior of process spawning mechanisms which often inherit the parent's environment unless specifically configured otherwise. In this case, the implementation did not enforce a strict whitelist approach to allowed environment variables nor did it perform a thorough cleanup before execution. Consequently, any variable present in the host system’s memory space becomes accessible within the JavaScript runtime context via standard accessors such as process.env. This effectively bypasses isolation boundaries that are typically expected when executing untrusted or semi-trusted code snippets provided by users or automated systems.
The operational impact of this vulnerability is severe due to the potential for significant data exfiltration. Attackers who can inject malicious JavaScript payloads into the js_execution tool can programmatically read sensitive configuration details including API keys, cloud provider credentials, database connection strings, and authentication tokens stored in environment variables. These leaked secrets are then transmitted back to the model context or output stream, allowing adversaries to compromise downstream systems that rely on these credentials for access control and authorization. This scenario is particularly dangerous in continuous integration pipelines, automated development environments, or any system where CodeWhale processes code snippets with elevated privileges.
This vulnerability aligns closely with CWE-798: Use of Hard-coded Credentials when considering the exposure of secrets via environment variables, as well as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. From a threat modeling perspective using the MITRE ATT&CK framework, this behavior facilitates Credential Access through techniques such as OS Credential Dumping or Unsecured Credentials in Environment Variables. The attack vector allows for remote code execution leading directly to privilege escalation and lateral movement if those credentials are reused across infrastructure components.
To mitigate this risk, organizations must immediately upgrade CodeWhale to version 0.8.64 or later where the issue has been addressed by implementing strict environment variable filtering during process creation. In addition to upgrading, it is recommended to enforce principle of least privilege by running execution environments with minimal permissions and avoiding storing high-value secrets in plain-text environment variables whenever possible. Utilizing dedicated secret management solutions that inject credentials at runtime through secure channels rather than relying on inherited shell environments can further reduce the attack surface associated with this class of vulnerabilities.