Is CVE-2026-75859 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-75859?

CVE-2026-75859 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-75859

Description

CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and injected into the AI system prompt for exfiltration.