139 matches found
NPM: CodeWhale: Project config `allow_shell` override enables arbitrary shell command execution via cloned repository
NPM: CodeWhale: Project config allowshell override enables arbitrary shell command execution via cloned repository vulnerability discovered by ? in WordPress Npm codewhale versions = 0.8.41, 0.8.64...
EUVD-2026-60969
CodeWhale: Project config allowshell override enables arbitrary shell command execution via cloned repository...
CodeWhale: Project config `allow_shell` override enables arbitrary shell command execution via cloned repository
Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 43563356b98c6b993085554da82e77370160a31c. Users should upgrade to 0.8.64 or later. The original reporter analysis is...
GHSA-GX45-XRJ5-G6C4 CodeWhale: Project config `allow_shell` override enables arbitrary shell command execution via cloned repository
Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 43563356b98c6b993085554da82e77370160a31c. Users should upgrade to 0.8.64 or later. The original reporter analysis is...
GHSA-WRJ3-VJ8C-784F CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE)
Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 57f3c89471e27ac4032d9791f6885e5d4408c381. Users should upgrade to 0.8.64 or later. The original reporter analysis is...
CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE)
Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 57f3c89471e27ac4032d9791f6885e5d4408c381. Users should upgrade to 0.8.64 or later. The original reporter analysis is...
NPM: CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE)
NPM: CodeWhale: rlmeval auto-approves arbitrary Python execution, bypassing the user's approval policy RCE vulnerability discovered by ? in WordPress Npm codewhale versions = 0.8.41, 0.8.64...
NPM: CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE)
NPM: CodeWhale: rlmeval auto-approves arbitrary Python execution, bypassing the user's approval policy RCE vulnerability discovered by ? in WordPress Npm deepseek-tui versions = 0.8.33, 0.8.41...
EUVD-2026-60965
CodeWhale: rlmeval auto-approves arbitrary Python execution, bypassing the user's approval policy RCE...
CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval
Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020. Users should upgrade to 0.8.64 or later. The original reporter analysis is...
NPM: CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval
NPM: CodeWhale: Argument Injection in gitblame Tool Allows Arbitrary File Read Without Approval vulnerability discovered by ? in WordPress Npm codewhale versions = 0.8.41, 0.8.64...
NPM: CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval
NPM: CodeWhale: Argument Injection in gitblame Tool Allows Arbitrary File Read Without Approval vulnerability discovered by ? in WordPress Npm deepseek-tui versions = 0.3.27, 0.8.41...
EUVD-2026-60970
CodeWhale: Argument Injection in gitblame Tool Allows Arbitrary File Read Without Approval...
GHSA-C6MW-8XH8-GPQ6 CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval
Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020. Users should upgrade to 0.8.64 or later. The original reporter analysis is...
NPM: CodeWhale: SSRF bypass - TOCTOU on DNS failure for DNS pinning
TOCTOU on DNS failure for DNS pinning vulnerability discovered by ? in WordPress Npm codewhale versions = 0.8.41, 0.8.64...
GHSA-6V2G-FPXH-PMMH CodeWhale: SSRF bypass - TOCTOU on DNS failure for DNS pinning
Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e. Users should upgrade to 0.8.64 or later. The original reporter analysis is...
EUVD-2026-60963
CodeWhale: SSRF bypass - TOCTOU on DNS failure for DNS pinning...
CodeWhale: SSRF bypass - TOCTOU on DNS failure for DNS pinning
Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e. Users should upgrade to 0.8.64 or later. The original reporter analysis is...
CodeWhale: js_execution leaks parent environment to model context via missing env scrub
Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e. Users should upgrade to 0.8.64 or later. The original reporter analysis is...
GHSA-H539-C7R8-3XQ4 CodeWhale: js_execution leaks parent environment to model context via missing env scrub
Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e. Users should upgrade to 0.8.64 or later. The original reporter analysis is...