Skip to content
AI Sec Watch
HighVulnerabilityLLM-specific

GHSA-62f5-cp2p-vq95: CodeWhale: Project config `instructions` override enables arbitrary file read into AI system prompt via cloned repository

Source
GitHub Advisory(opens in a new tab)
Identifiers
CVE-2026-75859GHSA-62f5-cp2p-vq95
Published
Record updated
View JSON
Affected
  • codewhale >= 0.8.41, < 0.8.64, fixed in 0.8.64, released June 22, 2026, 73 days before disclosure
  • codewhale-tui >= 0.8.41, < 0.8.64, fixed in 0.8.64, released June 22, 2026, 74 days before disclosure
  • deepseek-tui >= 0.8.8, < 0.8.41, fixed in 0.8.41, released May 23, 2026, 104 days before disclosure
Known exploitation
Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS
0.5%

Summary

CodeWhale's project config merge copies the `instructions` array from a repository's `.codewhale/config.toml` or `.deepseek/config.toml` into the session without path validation. The listed paths are expanded via `expand_path`, read from disk with no workspace boundary check, and injected into the AI system prompt, so a malicious cloned repository can expose files such as `~/.ssh/id_rsa` through the conversation. The advisory notes that the 100KB cap, the `DENY_AT_PROJECT_SCOPE` list and the lack of a tightening guard do not prevent this.

Mitigation

Fixed in 0.8.64 (commit 43563356b98c6b993085554da82e77370160a31c). Users should upgrade to 0.8.64 or later.

Related items