140 matches found
CodeWhale: js_execution leaks parent environment to model context via missing env scrub
Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e. Users should upgrade to 0.8.64 or later. The original reporter analysis is...
GHSA-H539-C7R8-3XQ4 CodeWhale: js_execution leaks parent environment to model context via missing env scrub
Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e. Users should upgrade to 0.8.64 or later. The original reporter analysis is...
NPM: CodeWhale: js_execution leaks parent environment to model context via missing env scrub
NPM: CodeWhale: jsexecution leaks parent environment to model context via missing env scrub vulnerability discovered by ? in WordPress Npm codewhale versions = 0.8.41, 0.8.64...
CodeWhale: Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Approval
Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020. Users should upgrade to 0.8.64 or later. The original reporter analysis is...
NPM: CodeWhale: Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Approval
NPM: CodeWhale: Argument Injection in gitshow Tool Allows Arbitrary File Write Without Approval vulnerability discovered by ? in WordPress Npm deepseek-tui versions = 0.3.27, 0.8.41...
NPM: CodeWhale: Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Approval
NPM: CodeWhale: Argument Injection in gitshow Tool Allows Arbitrary File Write Without Approval vulnerability discovered by ? in WordPress Npm codewhale versions = 0.8.41, 0.8.64...
GHSA-7J5W-7R7X-9V27 CodeWhale: Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Approval
Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020. Users should upgrade to 0.8.64 or later. The original reporter analysis is...
EUVD-2026-60971
CodeWhale: Argument Injection in gitshow Tool Allows Arbitrary File Write Without Approval...
CodeWhale: exec_shell_interact sends LLM-controlled input to a running shell without an approval prompt (privilege escalation)
Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 57f3c89471e27ac4032d9791f6885e5d4408c381. Users should upgrade to 0.8.64 or later. The original reporter analysis is...
NPM: CodeWhale: exec_shell_interact sends LLM-controlled input to a running shell without an approval prompt (privilege escalation)
NPM: CodeWhale: execshellinteract sends LLM-controlled input to a running shell without an approval prompt privilege escalation vulnerability discovered by ? in WordPress Npm codewhale versions = 0.8.41, 0.8.64...
EUVD-2026-60964
CodeWhale: execshellinteract sends LLM-controlled input to a running shell without an approval prompt privilege escalation...
GHSA-G29H-PFMP-QP9R CodeWhale: exec_shell_interact sends LLM-controlled input to a running shell without an approval prompt (privilege escalation)
Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 57f3c89471e27ac4032d9791f6885e5d4408c381. Users should upgrade to 0.8.64 or later. The original reporter analysis is...
NPM: CodeWhale: Project config `instructions` override enables arbitrary file read into AI system prompt via cloned repository
NPM: CodeWhale: Project config instructions override enables arbitrary file read into AI system prompt via cloned repository vulnerability discovered by ? in WordPress Npm deepseek-tui versions = 0.8.8, 0.8.41...
NPM: CodeWhale: Project config `instructions` override enables arbitrary file read into AI system prompt via cloned repository
NPM: CodeWhale: Project config instructions override enables arbitrary file read into AI system prompt via cloned repository vulnerability discovered by ? in WordPress Npm codewhale versions = 0.8.41, 0.8.64...
CodeWhale: Project config `instructions` override enables arbitrary file read into AI system prompt via cloned repository
Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 43563356b98c6b993085554da82e77370160a31c. Users should upgrade to 0.8.64 or later. The original reporter analysis is...
EUVD-2026-60966
CodeWhale: Project config instructions override enables arbitrary file read into AI system prompt via cloned repository...
GHSA-62F5-CP2P-VQ95 CodeWhale: Project config `instructions` override enables arbitrary file read into AI system prompt via cloned repository
Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 43563356b98c6b993085554da82e77370160a31c. Users should upgrade to 0.8.64 or later. The original reporter analysis is...
CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes
Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e. Users should upgrade to 0.8.64 or later. The original reporter analysis is...
NPM: CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes
NPM: CodeWhale: imageanalyze follows workspace symlinks, leaking external file bytes vulnerability discovered by ? in WordPress Npm codewhale versions = 0.8.41, 0.8.64...
NPM: CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes
NPM: CodeWhale: imageanalyze follows workspace symlinks, leaking external file bytes vulnerability discovered by ? in WordPress Npm deepseek-tui versions = 0.8.32, 0.8.41...