{"uuid": "504d0b19-a99f-4f47-9575-ab6a2f47397e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75914", "type": "seen", "source": "https://gist.github.com/alon710/5450dc0367b1b3821398b1bbcad341e1", "content": "# CVE-2026-75914: CVE-2026-75914: Improper Link Resolution and Path Traversal in CodeWhale image_analyze Tool\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-75914\n\n## Summary\nAn improper link resolution vulnerability (CWE-59) in the image_analyze tool of CodeWhale allows remote attackers to traverse directories (CWE-22) and leak sensitive local files via symlink manipulation.\n\n## TL;DR\nCodeWhale versions prior to 0.8.64 are vulnerable to a path traversal attack. By introducing a symbolic link inside the agent workspace that points to a sensitive host file but naming it with an image extension, attackers can force the image_analyze tool to read the target file, encode its contents, and leak them directly to a vision LLM endpoint without user consent.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **Primary CWE ID**: CWE-22\n- **Secondary CWE ID**: CWE-59\n- **Attack Vector**: Network\n- **CVSS v4.0 Base Score**: 8.7 (High)\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- CodeWhale Terminal Coding Agent\n- **CodeWhale**: >= 0.8.32, < 0.8.64 (Fixed in: `0.8.64`)\n\n## Mitigation\n\n- Upgrade CodeWhale to version 0.8.64 or higher to enforce canonicalized path validation.\n- Run autonomous agents inside containerized, sandboxed environments with read-only filesystems.\n- Restrict network outbound access of the agent to trusted LLM endpoints to limit data exfiltration paths.\n\n**Remediation Steps:**\n1. Identify all installations of CodeWhale in local development and production environments.\n2. For Cargo-based installations, execute: cargo install codewhale --version 0.8.64 --force\n3. Scan existing workspace directories for out-of-boundary symbolic links using automated find scripts.\n\n## References\n\n- [GitHub Security Advisory GHSA-w7wx-5q49-r59w](https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-w7wx-5q49-r59w)\n- [VulnCheck Advisory for CodeWhale](https://www.vulncheck.com/advisories/codewhale-before-path-traversal-via-image-analyze-symlink)\n- [NVD CVE-2026-75914 Record](https://nvd.nist.gov/vuln/detail/CVE-2026-75914)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-75914) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T18:32:13.557784Z"}