CVE-2026-75912: CVE-2026-75912: Argument Injection and Arbitrary File Disclosure in CodeWhale Git Tools

#security #cve #cybersecurity

CVE-2026-75912: Argument Injection and Arbitrary File Disclosure in CodeWhale Git Tools

Vulnerability ID: CVE-2026-75912
CVSS Score: 8.3
Published: 2026-09-04

An argument injection vulnerability in CodeWhale (CVE-2026-75912 / GHSA-c6mw-8xh8-gpq6) allows unauthenticated remote attackers to execute arbitrary option commands on the git binary. By passing malicious command-line flags inside git_blame and git_show tool helper functions, an attacker can bypass typical access controls to read arbitrary local system files via the underlying git process.

TL;DR

An input validation failure in CodeWhale allows attackers to inject Git command-line options via tool revision parameters, enabling arbitrary file disclosure from the hosting environment.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Attack Vector: Network / Remote
CVSS v4.0 Base Score: 8.3
EPSS Score: 0.00322
Impact: High (Arbitrary File Disclosure)
Exploit Status: poc
KEV Status: Not Listed

Affected Systems

CodeWhale AI-Assisted TUI Platform (Rust)
CodeWhale: >= 0.3.27, < 0.8.41 (Fixed in: 0.8.41)
CodeWhale: >= 0.8.41, < 0.8.64 (Fixed in: 0.8.64)

Code Analysis

Commit: 9a34b50

Fix argument injection vulnerability in Git history tools (git show & git blame) by introducing input validation logic in validate_git_rev to block options starting with '-'.

--- a/crates/tui/src/tools/git_history.rs
+++ b/crates/tui/src/tools/git_history.rs
@@ -204,6 +204,7 @@ impl ToolSpec for GitShowTool {
     async fn execute(&self, input: Value, context: &ToolContext) -> Result<ToolResult, ToolError> {
         let rev = required_str(&input, "rev")?;
+        validate_git_rev(rev)?;

Exploit Details

GitHub Security Advisory: Exploit concepts and vulnerability validation mechanisms identified in tool components.

Mitigation Strategies

Restrict network access to local development workstations running CodeWhale.
Enforce process execution policies that prevent terminal-based development tools from accessing system-level directories.
Ensure prompt-injection defenses are in place when using CodeWhale to inspect untrusted repositories.

Remediation Steps:

Upgrade CodeWhale instances to version 0.8.41 or 0.8.64 and above immediately.
Verify system logs to detect any unauthorized access to files such as /etc/passwd or SSH key locations.
Utilize static analysis tools to verify that other git helper utilities are not executing dynamic arguments without sanitization.

References

Read the full report for CVE-2026-75912 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community