CVE-2026-75859: CodeWhale: Project config `instructions` override enables arbitrary file read into AI system prompt via cloned repository
A malicious .codewhale/config.toml or .deepseek/config.toml committed to a repository can set instructions to an array of arbitrary file paths (including paths outside the workspace like ~/.ssh/id_rsa or ~/.aws/credentials) that are read from disk and injected into the AI model’s system prompt. There is no path validation, workspace boundary check, or tightening guard on the instructions field. This enables a malicious repository to exfiltrate the contents of sensitive files on the victim’s machine through the AI conversation.
References
- github.com/Hmbown/CodeWhale/commit/43563356b98c6b993085554da82e77370160a31c
- github.com/Hmbown/CodeWhale/security/advisories/GHSA-62f5-cp2p-vq95
- github.com/advisories/GHSA-62f5-cp2p-vq95
- nvd.nist.gov/vuln/detail/CVE-2026-75859
- www.vulncheck.com/advisories/codewhale-before-arbitrary-file-read-via-instructions
Code Behaviors & Features
Detect and mitigate CVE-2026-75859 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →