CVE-2026-75913 CodeWhale before 0.8.64 Argument Injection via git_show

CodeWhale codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain an argument injection vulnerability in the gitshow tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted ...

CVE-2026-75913

CodeWhale codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain an argument injection vulnerability in the gitshow tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted ...

CVE-2026-75913 CodeWhale before 0.8.64 Argument Injection via git_show

CodeWhale codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain an argument injection vulnerability in the gitshow tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted ...

EUVD-2026-60971

CodeWhale codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain an argument injection vulnerability in the gitshow tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted ...

CVE-2026-75912

CodeWhale's git_blame tool passes an unvalidated rev parameter directly to git, allowing attackers to inject options like --contents=/path/to/file to exfiltrate sensitive files (SSH keys, credentials) via tool output. CVSS 3.1 score 7.4 (High). Fixed in CodeWhale 0.8.64. No in-the-wild exploitati...

CVE-2026-75912

CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the gitblame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files...

EUVD-2026-60970

CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the gitblame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files...

CVE-2026-75912 CodeWhale before 0.8.64 Argument Injection via git_blame

CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the gitblame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files...

EUVD-2026-60966

CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and inject...

CVE-2026-75859

CodeWhale before 0.8.64 fails to validate file paths in the project config instructions field. A malicious .codewhale/config.toml in a cloned repo can read files outside the workspace and inject their contents into the AI system prompt, enabling exfiltration. CVSS 7.5 HIGH. Patch released; no kno...

CVE-2026-75859 CodeWhale before 0.8.64 Arbitrary File Read via instructions

CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and inject...

CVE-2026-75859

CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and inject...

CVE-2026-75859 CodeWhale before 0.8.64 Arbitrary File Read via instructions

CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and inject...

CVE-2026-73996

Unauthenticated Arbitrary File Upload in Masteriyo - LMS = 2.3.2 versions...

CVE-2026-73383

Shop manager Arbitrary File Download in CTX Feed = 6.6.47 versions...

CVE-2026-73181

Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...

CVE-2026-66627

Contributor Arbitrary File Upload in GP Premium = 2.5.5 versions...

CVE-2026-48798

SSH.NET is a Secure Shell SSH library for .NET. In 2025.1.0 and earlier, ScpClient.Downloadstring directoryName, DirectoryInfo directoryInfo trusts file and directory names returned by a remote SCP server and combines them with the requested local directory without containment validation, allowin...

CVE-2026-32474

Contributor Arbitrary File Upload in Templatiq = 0.2.5 versions...

CVE-2026-63328 Trivy: Path Traversal in Trivy Plugin Manager Allows Arbitrary File Write

Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under /.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and...