p PatchFirst

CVE-2026-75914

CVE-2026-75914 · CodeWhale before 0.8.64 Path Traversal via image_analyze symlink

This page contains facts from public vulnerability sources. Check the original advisory before updating.

CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without user approval.

CVSS 8.7 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • codewhale

    Versions
    • ≥ 0.8.32, < 0.8.41: Affected (semver)
    • 0.8.41: Not affected (semver)

    Update to 0.8.41

  • codewhale

    Versions
    • ≥ 0.8.41, < 0.8.64: Affected (semver)
    • 0.8.64: Not affected (semver)

    Update to 0.8.64

  • deepseek-tui crates.io

    Affected ranges
    • SEMVER: ≥ 0.8.32, ≤ 0.8.41

    No fix published

  • deepseek-tui npm

    Affected ranges
    • SEMVER: ≥ 0.8.32, < 0.8.41

    Update to 0.8.41

  • codewhale-tui crates.io

    Affected ranges
    • SEMVER: ≥ 0.8.41, < 0.8.64

    Update to 0.8.64

  • codewhale npm

    Affected ranges
    • SEMVER: ≥ 0.8.41, < 0.8.64

    Update to 0.8.64

Original sources

Check your server →