HighVulnerabilityLLM-specific
GHSA-c6mw-8xh8-gpq6: CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval
- Identifiers
- CVE-2026-75912GHSA-c6mw-8xh8-gpq6
- Published
- Record updated
- Affected
- codewhale >= 0.8.41, < 0.8.64, fixed in 0.8.64, released June 22, 2026, 73 days before disclosure
- codewhale-tui >= 0.8.41, < 0.8.64, fixed in 0.8.64, released June 22, 2026, 74 days before disclosure
- deepseek-tui >= 0.3.27, < 0.8.41, fixed in 0.8.41, released July 27, 2026, 38 days before disclosure
- and 1 more
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.4%
Summary
The `git_blame` tool in DeepSeek-TUI passes the model-supplied `rev` parameter unvalidated into the argv of `git blame`. A `rev` value of `--contents=/path/to/secret` makes the tool echo the targeted file's contents into the tool result, which returns to the model and appears in the chat transcript, enabling arbitrary file read at the invoking user's privilege. The tool is registered with `ApprovalRequirement::Auto`, so no approval is requested.
Mitigation
Fixed in 0.8.64 (commit 9a34b5034d29f05d1f28fa61b04719ca6a741020). Users should upgrade to 0.8.64 or later.
Related items
- MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
- InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
- InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
- MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
- HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database