CodeWhale before 0.8.64 Environment Variable Leak via js_execution
Published Aug 18, 2026
8.7
HIGHCVSS 4.0
EPSS 0.68%
Description
CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API keys, cloud credentials, and authentication tokens back to the model context.
Affected products
-
- Version 0.8.32StatusaffectedConstraints<0.8.41
- Version 0.8.41StatusaffectedConstraints<0.8.64
- Version 0.8.41StatusunaffectedConstraints-
- Version 0.8.64StatusunaffectedConstraints-
- Version
No data.
No data.
No Red Hat product state for this CVE.
deepseek-tui
crates.io
Introduced 0.8.32 Fixed not fixeddeepseek-tui
npm
Introduced 0.8.32 Fixed 0.8.41codewhale-tui
crates.io
Introduced 0.8.41 Fixed 0.8.64codewhale
npm
Introduced 0.8.41 Fixed 0.8.64
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | deepseek-tui | 0.8.32 | not fixed |
| npm | deepseek-tui | 0.8.32 | 0.8.41 |
| crates.io | codewhale-tui | 0.8.41 | 0.8.64 |
| npm | codewhale | 0.8.41 | 0.8.64 |
Remediation
No remediation recorded yet.
Metrics
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
1 other source (NVD) ▾
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
PoCAutomatable
YesTechnical Impact
PartialDecision
n/aAssessed Aug 18, 2026 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
Aug–Oct 2026- EPSS v5
Percentile over time
- EPSS v5
Table of values (2 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 0.68% (0.00678) | 50.55th | v5 (v2026.06.15) |
| Aug 19, 2026 | 0.50% (0.00504) | 41.02th | v5 (v2026.06.15) |
References (5)
- https://github.com/Hmbown/CodeWhale/commit/26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e patch
- https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-h539-c7r8-3xq4 exploitvendor-advisory
- https://github.com/advisories/GHSA-h539-c7r8-3xq4 Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-75915
- https://www.vulncheck.com/advisories/codewhale-before-environment-variable-leak-via-js-execution third-party-advisory
Change history (0)
No recorded changes yet.