EUVD-2026-60970

CodeWhale: Argument Injection in gitblame Tool Allows Arbitrary File Read Without Approval...

NPM: CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval

NPM: CodeWhale: Argument Injection in gitblame Tool Allows Arbitrary File Read Without Approval vulnerability discovered by ? in WordPress Npm codewhale versions = 0.8.41, 0.8.64...

GHSA-C6MW-8XH8-GPQ6 CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval

Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020. Users should upgrade to 0.8.64 or later. The original reporter analysis is...

CVE-2026-75912

CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the gitblame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files...