Description
CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without user approval.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Hmbown CodeWhale
Default version status: unaffected
0.8.32 to < 0.8.41affected0.8.41unaffected
pkg:cargo/deepseek-tuiHmbown CodeWhale
Default version status: unaffected
0.8.32 to < 0.8.41affected0.8.41unaffected
pkg:npm/deepseek-tuiHmbown CodeWhale
Default version status: unaffected
0.8.41 to < 0.8.64affected0.8.64unaffected
pkg:cargo/codewhale-tuiHmbown CodeWhale
Default version status: unaffected
0.8.41 to < 0.8.64affected0.8.64unaffected
pkg:npm/codewhale