{"vulnerability": "cve-2026-7591", "sightings": [{"uuid": "f17c3497-ec6e-4843-9852-a0ed39ed534f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75917", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mth4j6euhr2e", "content": "\ud83d\udea8 CVE-2026-75917 \u2014 CVSS 9.3 CRITICAL\n\nSiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree picker's hover-tooltip ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-75917\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-19T16:08:48.228046Z"}, {"uuid": "e82799b3-6065-411c-9b5e-68a4b0b43304", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75916", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mth4iv4e5l2j", "content": "\ud83d\udea8 CVE-2026-75916 \u2014 CVSS 9.3 CRITICAL\n\nSiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '((' block-reference autocomplete...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-75916\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-19T16:08:38.419871Z"}, {"uuid": "5709d0a3-609d-4dbb-a41e-98c5d7906455", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75916", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mth55ezgsw2t", "content": "CVE-2026-75916 - siyuan\nA security issue in SiYuan's block hint popup allows attackers to inject malicious code that can execute on users' devices. This can happen when a user types a specific phrase and a\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#siyuan #siyuannote #CVE #infosec", "creation_timestamp": "2026-08-19T16:20:05.730873Z"}, {"uuid": "e1787d3d-45d4-4f78-bff0-2c643d1fe5fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75917", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mth5p7wozr2t", "content": "CVE-2026-75917 - siyuan\nA vulnerability in SiYuan allows attackers to create malicious documents that can execute OS commands when a victim interacts with them. This can happen if the victim receives a\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#siyuan #siyuannote #CVE #infosec", "creation_timestamp": "2026-08-19T16:30:04.887216Z"}, {"uuid": "6120dec6-5d26-4a85-bc8e-2f037e7f8e42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75913", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/jirpv6fp43oyf", "content": "CVE-2026-75913 - CodeWhale before 0.8.64 Argument Injection via git_show\nCVE ID : CVE-2026-75913\n \n Published : Aug. 18, 2026, 3:22 p.m. | 51\u00a0minutes ago\n \n Description : CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain an argument injection ...", "creation_timestamp": "2026-08-18T16:21:37.324583Z"}, {"uuid": "a1f1a330-6eea-4daa-9b9d-1b413289b52e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75915", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/7g2vbdpdike67", "content": "CVE-2026-75915 - CodeWhale before 0.8.64 Environment Variable Leak via js_execution\nCVE ID : CVE-2026-75915\n \n Published : Aug. 18, 2026, 3:22 p.m. | 51\u00a0minutes ago\n \n Description : CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the ...", "creation_timestamp": "2026-08-18T16:27:37.593512Z"}, {"uuid": "1a06e03b-1be5-4dd5-82ee-392eacf62897", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75914", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/7zntx7kh7mho3", "content": "CVE-2026-75914 - CodeWhale before 0.8.64 Path Traversal via image_analyze symlink\nCVE ID : CVE-2026-75914\n \n Published : Aug. 18, 2026, 3:22 p.m. | 51\u00a0minutes ago\n \n Description : CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool...", "creation_timestamp": "2026-08-18T16:33:37.578602Z"}, {"uuid": "cb0028f2-0716-485c-8146-4fa2a31f3688", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75911", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mteoxsbsip2o", "content": "\ud83d\udfe0 CVE-2026-75911 - High (7.8)\n\nCodeWhale versions before 0.8.64 fail to properly validate the allow_shell configuration paramete...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-75911/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-18T17:01:07.468987Z"}, {"uuid": "940d825d-e2ac-4a04-95c4-375d28e2b45e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75913", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mteoxzg7ji26", "content": "\ud83d\udd34 CVE-2026-75913 - Critical (9.3)\n\nCodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain an argument inje...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-75913/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-18T17:01:15.017055Z"}, {"uuid": "74777d73-94f9-4caa-b995-eaabafab4ffb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75914", "type": "seen", "source": "https://bsky.app/profile/thestandup.bsky.social/post/3mupk5nd6d22k", "content": "CVE-2026-75914, rated high, in deepseek-tui: its image_analyze tool follows symlinks inside the workspace, so a linked path outside it gets read and its bytes sent to the vision endpoint. The maintainers validated the report; 0.8.64 carries the fix. #dev", "creation_timestamp": "2026-09-04T17:59:23.397274Z"}, {"uuid": "504d0b19-a99f-4f47-9575-ab6a2f47397e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75914", "type": "seen", "source": "https://gist.github.com/alon710/5450dc0367b1b3821398b1bbcad341e1", "content": "# CVE-2026-75914: CVE-2026-75914: Improper Link Resolution and Path Traversal in CodeWhale image_analyze Tool\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-75914\n\n## Summary\nAn improper link resolution vulnerability (CWE-59) in the image_analyze tool of CodeWhale allows remote attackers to traverse directories (CWE-22) and leak sensitive local files via symlink manipulation.\n\n## TL;DR\nCodeWhale versions prior to 0.8.64 are vulnerable to a path traversal attack. By introducing a symbolic link inside the agent workspace that points to a sensitive host file but naming it with an image extension, attackers can force the image_analyze tool to read the target file, encode its contents, and leak them directly to a vision LLM endpoint without user consent.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **Primary CWE ID**: CWE-22\n- **Secondary CWE ID**: CWE-59\n- **Attack Vector**: Network\n- **CVSS v4.0 Base Score**: 8.7 (High)\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- CodeWhale Terminal Coding Agent\n- **CodeWhale**: >= 0.8.32, < 0.8.64 (Fixed in: `0.8.64`)\n\n## Mitigation\n\n- Upgrade CodeWhale to version 0.8.64 or higher to enforce canonicalized path validation.\n- Run autonomous agents inside containerized, sandboxed environments with read-only filesystems.\n- Restrict network outbound access of the agent to trusted LLM endpoints to limit data exfiltration paths.\n\n**Remediation Steps:**\n1. Identify all installations of CodeWhale in local development and production environments.\n2. For Cargo-based installations, execute: cargo install codewhale --version 0.8.64 --force\n3. Scan existing workspace directories for out-of-boundary symbolic links using automated find scripts.\n\n## References\n\n- [GitHub Security Advisory GHSA-w7wx-5q49-r59w](https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-w7wx-5q49-r59w)\n- [VulnCheck Advisory for CodeWhale](https://www.vulncheck.com/advisories/codewhale-before-path-traversal-via-image-analyze-symlink)\n- [NVD CVE-2026-75914 Record](https://nvd.nist.gov/vuln/detail/CVE-2026-75914)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-75914) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T18:32:13.557784Z"}, {"uuid": "7027a16f-f7e8-4b30-b3b7-e4c5ce60cd6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-75914", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-w7wx-5q49-r59w", "content": "", "creation_timestamp": "2026-09-04T18:35:04.152443Z"}, {"uuid": "1948c52d-5453-4a30-903d-c2cc90d2b3ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-75912", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-c6mw-8xh8-gpq6", "content": "", "creation_timestamp": "2026-09-04T20:35:06.970065Z"}, {"uuid": "f6f13128-b6a3-4978-ac99-dd257575edf6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75913", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mupp7strmp2g", "content": "CVE-2026-75913 - codewhale\nCodeWhale versions 0.8.41 to 0.8.64 are at risk of a security threat. An attacker can use a malicious repository to write unauthorized files on the user's computer,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#codewhale #hmbown #rust #CVE #infosec", "creation_timestamp": "2026-09-04T19:30:04.277735Z"}, {"uuid": "d7814e3d-a5c8-41c1-875d-7bd66f07d5e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75911", "type": "seen", "source": "https://gist.github.com/alon710/bb4cbf99c94a659593e6b177ff58789d", "content": "# CVE-2026-75911: CVE-2026-75911: Remote Code Execution via Configuration Override in CodeWhale\n\n> **CVSS Score:** 8.5\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-75911\n\n## Summary\nCVE-2026-75911 is a configuration injection and remote code execution vulnerability in CodeWhale. Unsafe merging of repository-level TOML configuration files allows malicious repositories to silently enable shell tool registration and inject prompts, forcing the integrated LLM agent to execute arbitrary host commands.\n\n## TL;DR\nInsecure workspace configuration merging in CodeWhale lets a malicious git repository silently enable shell access and execute arbitrary commands via prompt injection when the workspace is opened.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94\n- **Attack Vector**: Local (User-initiated clone & open)\n- **CVSS v4.0**: 8.5 (High)\n- **CVSS v3.1**: 7.8 (High)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- CodeWhale Terminal User Interface (TUI) workspace environment\n- **CodeWhale**: >= 0.8.6, < 0.8.41 (Fixed in: `0.8.41`)\n- **CodeWhale**: >= 0.8.41, < 0.8.64 (Fixed in: `0.8.64`)\n\n## Mitigation\n\n- Disable workspace configurations completely when running untrusted code\n- Restrict shell access in global configs\n- Isolate terminal developer tools in sandboxed containers (Docker, DevContainers)\n\n**Remediation Steps:**\n1. Upgrade CodeWhale client to version 0.8.64 or later.\n2. Verify and sanitize existing .codewhale configurations in local directories.\n3. Explicitly configure 'allow_shell = false' globally to enforce a safe baseline.\n\n## References\n\n- [GitHub Security Advisory GHSA-gx45-xrj5-g6c4](https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-gx45-xrj5-g6c4)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/codewhale-before-remote-code-execution-via-allow-shell)\n- [NVD Record](https://nvd.nist.gov/vuln/detail/CVE-2026-75911)\n- [CVE-2026-75911 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-75911)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-75911) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T19:31:35.022727Z"}, {"uuid": "2ef9295d-8bd0-441d-a50f-e2a6692ad0c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-75913", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-7j5w-7r7x-9v27", "content": "", "creation_timestamp": "2026-09-04T20:35:13.326202Z"}, {"uuid": "b9e233c7-a8f5-4561-a5f5-11bd3faae16c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-75915", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-h539-c7r8-3xq4", "content": "", "creation_timestamp": "2026-09-04T20:35:11.211278Z"}, {"uuid": "77a83fae-f197-42a1-bfb6-61f7609b3b89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-75911", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-gx45-xrj5-g6c4", "content": "", "creation_timestamp": "2026-09-04T20:35:02.707185Z"}, {"uuid": "45870e50-0bc2-4666-b391-e13056224cb8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75912", "type": "seen", "source": "https://gist.github.com/alon710/25de86a6a1fbd873e6db813795a47505", "content": "# CVE-2026-75912: CVE-2026-75912: Argument Injection and Arbitrary File Disclosure in CodeWhale Git Tools\n\n> **CVSS Score:** 8.3\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-75912\n\n## Summary\nAn argument injection vulnerability in CodeWhale (CVE-2026-75912 / GHSA-c6mw-8xh8-gpq6) allows unauthenticated remote attackers to execute arbitrary option commands on the git binary. By passing malicious command-line flags inside git_blame and git_show tool helper functions, an attacker can bypass typical access controls to read arbitrary local system files via the underlying git process.\n\n## TL;DR\nAn input validation failure in CodeWhale allows attackers to inject Git command-line options via tool revision parameters, enabling arbitrary file disclosure from the hosting environment.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')\n- **Attack Vector**: Network / Remote\n- **CVSS v4.0 Base Score**: 8.3\n- **EPSS Score**: 0.00322\n- **Impact**: High (Arbitrary File Disclosure)\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- CodeWhale AI-Assisted TUI Platform (Rust)\n- **CodeWhale**: >= 0.3.27, < 0.8.41 (Fixed in: `0.8.41`)\n- **CodeWhale**: >= 0.8.41, < 0.8.64 (Fixed in: `0.8.64`)\n\n## Mitigation\n\n- Restrict network access to local development workstations running CodeWhale.\n- Enforce process execution policies that prevent terminal-based development tools from accessing system-level directories.\n- Ensure prompt-injection defenses are in place when using CodeWhale to inspect untrusted repositories.\n\n**Remediation Steps:**\n1. Upgrade CodeWhale instances to version 0.8.41 or 0.8.64 and above immediately.\n2. Verify system logs to detect any unauthorized access to files such as /etc/passwd or SSH key locations.\n3. Utilize static analysis tools to verify that other git helper utilities are not executing dynamic arguments without sanitization.\n\n## References\n\n- [NVD CVE-2026-75912 Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-75912)\n- [GitHub Security Advisory GHSA-c6mw-8xh8-gpq6](https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-c6mw-8xh8-gpq6)\n- [CVE.org CVE-2026-75912 Record](https://www.cve.org/CVERecord?id=CVE-2026-75912)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/codewhale-before-argument-injection-via-git-blame)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-75912) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-05T13:31:53.822638Z"}]}