CVE-2026-75913: Critical Argument Injection in CodeWhale git_show

CVE-2026-75913 is a critical (CVSS 9.3) argument injection in the CodeWhale terminal coding agent. Its git_show tool passed a model supplied revision straight to git, so a malicious repository plus prompt injection could write files without approval. Upgrade codewhale and codewhale-tui to 0.8.64 or later.

What's affected

• Product: CodeWhale, npm package codewhale and Rust crate codewhale-tui.
• Affected: versions 0.8.41 up to but not including 0.8.64.
• Fixed: 0.8.64, which adds validation of the revision value.
• Related ranges in the GitHub advisory: npm deepseek-tui from 0.3.27 before 0.8.41 (patched in 0.8.41). The advisory lists no patched version for the Rust deepseek-tui crate in that range.
• Weakness: CWE-73, external control of file name or path.
• CVSS 9.3 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H. Not listed in CISA KEV.

How to check if you're exposed

Check the installed version in each place you may have installed it.

npm ls -g codewhale
cargo install --list | grep -i codewhale

Also look in team tooling images and dev containers, because coding agents tend to get baked into them. If you find a version in the affected range, assume it can be steered by content in any repository you opened with it. Paste your lockfiles or package list into the free scan at gold.safeguard.sh/scan to match them against the advisory.

What to do now

1. Upgrade codewhale and codewhale-tui to 0.8.64 or later on every machine, image and CI runner.
2. Until then, do not run the agent on repositories you do not trust.
3. Check whether tools in your agent are marked as auto approved, and prefer approval for anything that touches git or the file system.
4. Review shell startup files, SSH authorized keys and git config on machines where the agent ran against untrusted code, since the record names these as targets.
5. Run coding agents under a low privilege account or in a sandbox, so a file write lands in a disposable area.

Why it matters

The tool was registered as auto approved and described as read only, but git itself has options that write output to a file. Because the revision string was not validated, a value shaped like an option was read as a flag. The agent trusted a string from the model, and the model could be steered by text in a repository.

That is the pattern to watch in agent tooling. Read only labels have to be true after argument parsing, not just in the tool description. Validate model supplied values at the tool boundary, and mark option parsing as ended before any user value.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• GitHub security advisory GHSA-7j5w-7r7x-9v27
• Fix commit 9a34b50
• VulnCheck advisory

Last reviewed: 19 October 2026.