CVE-2026-75912: Hmbown Codewhale

High severity, CVSS 7.4. EPSS: 0.4% chance of exploitation in the next 30 days.

CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files such as SSH keys and credentials through the tool output returned to the model.

Affected products

• Hmbown Codewhale: from 0.3.27, before 0.8.41 (fixed in 0.8.41); from 0.8.41, before 0.8.64 (fixed in 0.8.64)

Published 2026-08-18. Last modified 2026-09-08.