HighVulnerabilityLLM-specific
GHSA-h539-c7r8-3xq4: CodeWhale: js_execution leaks parent environment to model context via missing env scrub
- Identifiers
- CVE-2026-75915GHSA-h539-c7r8-3xq4
- Published
- Record updated
- Affected
- codewhale >= 0.8.41, < 0.8.64, fixed in 0.8.64, released June 22, 2026, 73 days before disclosure
- codewhale-tui >= 0.8.41, < 0.8.64, fixed in 0.8.64, released June 22, 2026, 74 days before disclosure
- deepseek-tui >= 0.8.32, < 0.8.41, fixed in 0.8.41, released July 27, 2026, 38 days before disclosure
- and 1 more
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.7%
Summary
The js_execution tool in CodeWhale spawns Node with tokio::process::Command::new without calling env_clear or the child_env scrubber that exec_shell, the Python REPL and the MCP launcher use. Model-provided JavaScript can therefore read process.env, and its output returns to the next model turn, exposing API keys, cloud credentials and forge tokens. With auto_approve enabled (YOLO mode), the JS runs without any prompt, so a prompt injection from a README, web page or MCP output can drain the environment.
Mitigation
Fixed in 0.8.64 (commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e). Users should upgrade to 0.8.64 or later.
Topics
Related items
- InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
- InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
- MediumDocker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) | Endor LabsSimilar attack · Endor Labs Blog
- MediumGoogle: LLMjacking attacks rack up $1 million in cloud AI chargesSimilar attack · BleepingComputer
- MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research