CVE-2026-75915 is an information exposure flaw (CWE-200) in the js_execution tool of CodeWhale. It starts Node.js without scrubbing the parent environment, so API keys and tokens can flow back to the model. The record rates it High at 7.5. Upgrade to version 0.8.64 or later.
What's affected
The record says CodeWhale before 0.8.64 is affected. The GitHub advisory (GHSA-h539-c7r8-3xq4) says the maintainers validated the report and that 0.8.64 contains the fix in commit 26de44a. It lists the codewhale-tui crate for versions from 0.8.41 up to before 0.8.64, the deepseek-tui crate for 0.8.32 up to before 0.8.41 with no patched version, and the deepseek-tui npm package for the same range, patched in 0.8.41.
Severity, as two sources state it. The record gives 7.5 (High) under CVSS 3.1. VulnCheck lists it at 8.7 (High) under CVSS 4.0. The advisory itself does not quote a score in the text we read.
How to check if you're exposed
Find which package and version you have.
cargo install --list | grep -i -E "codewhale|deepseek"
npm ls -g deepseek-tui
Then think about what is in the environment where the tool runs: cloud credentials, API keys for model providers, source forge tokens and CI variables. Anything in the environment of the parent process was reachable by the JavaScript the tool ran. If those values were present on a machine that ran an affected version, consider them exposed to the model context and to any logs of it.
What to do now
- Upgrade CodeWhale to 0.8.64 or later, or the deepseek-tui npm package to 0.8.41 or later, as the advisory says.
- Rotate API keys, cloud credentials and tokens that were in the environment when an affected version ran.
- Run coding agents with a minimal environment. Do not export secrets into the shell that starts them.
- Use short lived credentials for agent sessions, scoped to the task.
- Check provider and cloud logs for use of those credentials from places you do not expect.
Why it matters
The weakness is exposure of sensitive information, CWE-200. The advisory explains that the tool launches Node with a process spawn call and does not use the environment scrubber that the shell, Python and MCP launcher paths already use. JavaScript that the model writes can then read the whole environment and print it, and the output goes back into the next model turn.
For AI agents, the environment is a hidden channel: model written code runs with whatever the host process knows. Prompt injection from a web page or a file can steer the model to print it. The pattern to look for in any agent tool is whether every launch path starts from a clean environment and passes only what the task needs. KEV status is false.
Quick check
Is exploitation by a person needed?
The advisory describes model written JavaScript reading the environment. A malicious prompt or file could be the source of that code.
Should I rotate credentials?
If an affected version ran with secrets in its environment, rotating them is the safe choice.
Sources
Last reviewed: 18 October 2026.
