Description
CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files such as SSH keys and credentials through the tool output returned to the model.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Hmbown CodeWhale
Default version status: unaffected
0.3.27 to < 0.8.41affected0.8.41unaffected
pkg:cargo/deepseek-tuiHmbown CodeWhale
Default version status: unaffected
0.3.27 to < 0.8.41affected0.8.41unaffected
pkg:npm/deepseek-tuiHmbown CodeWhale
Default version status: unaffected
0.8.41 to < 0.8.64affected0.8.64unaffected
pkg:cargo/codewhale-tuiHmbown CodeWhale
Default version status: unaffected
0.8.41 to < 0.8.64affected0.8.64unaffected
pkg:npm/codewhale