DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-75914: CVE-2026-75914: Improper Link Resolution and Path Traversal in CodeWhale image_analyze Tool

#security #cve #cybersecurity

CVE-2026-75914: Improper Link Resolution and Path Traversal in CodeWhale image_analyze Tool

Vulnerability ID: CVE-2026-75914
CVSS Score: 8.7
Published: 2026-09-04

An improper link resolution vulnerability (CWE-59) in the image_analyze tool of CodeWhale allows remote attackers to traverse directories (CWE-22) and leak sensitive local files via symlink manipulation.

TL;DR

CodeWhale versions prior to 0.8.64 are vulnerable to a path traversal attack. By introducing a symbolic link inside the agent workspace that points to a sensitive host file but naming it with an image extension, attackers can force the image_analyze tool to read the target file, encode its contents, and leak them directly to a vision LLM endpoint without user consent.

⚠️ Exploit Status: POC

Technical Details

  • Primary CWE ID: CWE-22
  • Secondary CWE ID: CWE-59
  • Attack Vector: Network
  • CVSS v4.0 Base Score: 8.7 (High)
  • Exploit Status: poc
  • CISA KEV Status: Not Listed

Affected Systems

  • CodeWhale Terminal Coding Agent
  • CodeWhale: >= 0.8.32, < 0.8.64 (Fixed in: 0.8.64)

Code Analysis

Commit: 26de44a

Hardened local tool trust boundaries by canonicalizing path structures and verifying absolute prefixes to prevent symbolic link escapes.

Exploit Details

  • GitHub Security Advisory: Official security advisory describing the path traversal and unsafe symbolic link resolution mechanics.

Mitigation Strategies

  • Upgrade CodeWhale to version 0.8.64 or higher to enforce canonicalized path validation.
  • Run autonomous agents inside containerized, sandboxed environments with read-only filesystems.
  • Restrict network outbound access of the agent to trusted LLM endpoints to limit data exfiltration paths.

Remediation Steps:

  1. Identify all installations of CodeWhale in local development and production environments.
  2. For Cargo-based installations, execute: cargo install codewhale --version 0.8.64 --force
  3. Scan existing workspace directories for out-of-boundary symbolic links using automated find scripts.

References

Read the full report for CVE-2026-75914 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)