CodeWhale Vulnerability CVE-2026-75913: Argument Injection Risk
- Severity
- CRITICAL
- CVSS
- 9.3
- Affected component
- codewhale (npm)
- Affected versions
- >= v0.8.60, <= v0.8.60 or >= v0.8.40, <= v0.8.40 or >= v0.8.63, <= v0.8.63 or >= v0.8.62, <= v0.8.62 or >= v0.8.61, <= v0.8.61 or >= v0.8.59, <= v0.8.59 or >= v0.8.58, <= v0.8.58 or >= v0.8.57, <= v0.8.57 or >= v0.8.56, <= v0.8.56 or >= v0.8.55, <= v0.8.55 or >= v0.8.53, <= v0.8.53 or >= v0.8.54, <= v0.8.54 or >= v0.8.52, <= v0.8.52 or >= v0.8.51, <= v0.8.51 or >= v0.8.50, <= v0.8.50 or >= v0.8.49, <= v0.8.49 or >= v0.8.48, <= v0.8.48 or >= v0.8.46, <= v0.8.46 or >= v0.8.45, <= v0.8.45 or >= v0.8.44, <= v0.8.44 or >= v0.8.43, <= v0.8.43 or >= v0.8.42, <= v0.8.42 or >= v0.8.41, <= v0.8.41 or >= v0.8.39, <= v0.8.39 or >= v0.8.38, <= v0.8.38 or >= v0.8.37, <= v0.8.37 or >= v0.8.36, <= v0.8.36 or >= v0.8.35, <= v0.8.35 or >= v0.8.33, <= v0.8.33 or >= v0.8.32, <= v0.8.32 or >= v0.8.31, <= v0.8.31 or >= v0.8.30, <= v0.8.30 or >= v0.8.28, <= v0.8.28 or >= v0.8.29, <= v0.8.29 or >= v0.8.27, <= v0.8.27 or >= v0.8.26, <= v0.8.26 or >= v0.8.25, <= v0.8.25 or >= v0.8.24, <= v0.8.24 or >= v0.8.23, <= v0.8.23 or >= v0.8.22, <= v0.8.22 or >= v0.8.21, <= v0.8.21 or >= v0.8.20, <= v0.8.20 or >= v0.8.19, <= v0.8.19 or >= v0.8.18, <= v0.8.18 or >= v0.8.17, <= v0.8.17 or >= v0.8.15, <= v0.8.15 or >= v0.8.14, <= v0.8.14 or >= v0.8.13, <= v0.8.13 or >= v0.8.12, <= v0.8.12 or >= v0.8.11, <= v0.8.11 or >= v0.8.10, <= v0.8.10 or >= v0.8.9, <= v0.8.9 or >= v0.8.8, <= v0.8.8 or >= v0.8.7, <= v0.8.7 or >= v0.8.6, <= v0.8.6 or >= v0.8.5, <= v0.8.5 or >= v0.8.4, <= v0.8.4 or >= v0.8.3, <= v0.8.3 or >= v0.8.2, <= v0.8.2 or >= v0.8.1, <= v0.8.1 or >= v0.8.0, <= v0.8.0 or >= v0.7.9, <= v0.7.9 or >= v0.7.8, <= v0.7.8 or >= v0.7.7, <= v0.7.7 or >= v0.7.6, <= v0.7.6 or >= v0.7.5, <= v0.7.5 or >= v0.7.4, <= v0.7.4 or >= v0.7.2, <= v0.7.2 or >= v0.7.1, <= v0.7.1 or >= v0.7.0, <= v0.7.0 or >= v0.6.7, <= v0.6.7 or >= v0.6.6, <= v0.6.6 or >= v0.6.5, <= v0.6.5 or >= v0.6.4, <= v0.6.4 or >= v0.6.3, <= v0.6.3 or >= v0.6.2, <= v0.6.2 or >= v0.6.1, <= v0.6.1 or >= v0.5.2, <= v0.5.2 or >= v0.5.1, <= v0.5.1 or >= v0.5.0, <= v0.5.0 or >= v0.4.9, <= v0.4.9 or >= v0.4.8, <= v0.4.8 or >= v0.4.7, <= v0.4.7 or >= v0.4.6, <= v0.4.6 or >= v0.4.5, <= v0.4.5 or >= v0.4.4, <= v0.4.4 or >= v0.4.3, <= v0.4.3 or >= v0.4.2, <= v0.4.2 or >= v0.4.1, <= v0.4.1 or >= v0.4.0, <= v0.4.0 or >= v0.3.33, <= v0.3.33 or >= v0.3.32, <= v0.3.32 or >= v0.3.31, <= v0.3.31 or >= v0.3.28, <= v0.3.28 or >= v0.3.27, <= v0.3.27
- Patched version
- 0.8.64
CodeWhale versions >= 0.8.41 and < 0.8.64 reportedly contain an argument injection vulnerability in the git_show tool, which could allow an attacker to write arbitrary files at the privilege of the invoking user.
What happened
CodeWhale versions >= 0.8.41 and < 0.8.64 appear to have an argument injection vulnerability in the git_show tool. This vulnerability allows an attacker to cause an unprompted arbitrary file write at the privilege of the invoking user. Sensitive files such as ~/.ssh/authorized_keys, ~/.bashrc, or ~/.gitconfig could be targeted. The vulnerability is due to the model-supplied rev parameter being passed unvalidated into the git show argv without an --end-of-options sentinel.
The vulnerability is fixed in version 0.8.64 by adding rev validation. Users of affected versions are advised to upgrade to the latest version to mitigate the risk.
What to do about it
- Upgrade to CodeWhale version 0.8.64 or later to mitigate the argument injection vulnerability.
- Review your system for any unauthorized changes to sensitive files such as ~/.ssh/authorized_keys, ~/.bashrc, or ~/.gitconfig.
- Monitor the primary sources for updates on this vulnerability.
How 0Day would have caught this
codewhale is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using CodeWhale versions >= 0.8.41 and < 0.8.64.
What should I do right now?
Upgrade to CodeWhale version 0.8.64 or later.
Has this vulnerability been exploited in the wild?
There is no confirmed report of this vulnerability being exploited in the wild at this time.