Description (CNA)
CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files such as SSH keys and credentials through the tool output returned to the model.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Hmbown / CodeWhale | affected 0.3.27 before 0.8.41; unaffected 0.8.41 |
| Hmbown / CodeWhale | affected 0.3.27 before 0.8.41; unaffected 0.8.41 |
| Hmbown / CodeWhale | affected 0.8.41 before 0.8.64; unaffected 0.8.64 |
| Hmbown / CodeWhale | affected 0.8.41 before 0.8.64; unaffected 0.8.64 |
CWE
CWE-88
References
- https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-c6mw-8xh8-gpq6
- https://github.com/Hmbown/CodeWhale/commit/9a34b5034d29f05d1f28fa61b04719ca6a741020
- https://www.vulncheck.com/advisories/codewhale-before-argument-injection-via-git-blame
ADP enrichment
No English description supplied.