{"items":[{"id":"NVI-00013929","kind":"vulnerability","title":"CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-c6mw-8xh8-gpq6","CVE-2026-75912"],"plain_summary":"GitHub lists this reviewed advisory for deepseek-tui, deepseek-tui, codewhale-tui, codewhale. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-2edb8922c5da33cb621c4d334a0ffc29"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-04T18:11:46.000Z","value":"7.4 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-1f28aac8b25f8f23bddb0cdaebce9665"},{"kind":"CVSS","as_of":"2026-10-22T22:10:00.250Z","value":"7.4 HIGH (3.1)","meaning":"disclosure@vulncheck.com severity; no combined Null risk score.","source_id":"sr-2edb8922c5da33cb621c4d334a0ffc29"},{"kind":"CVSS","as_of":"2026-10-22T22:10:00.250Z","value":"8.3 HIGH (4.0)","meaning":"disclosure@vulncheck.com severity; no combined Null risk score.","source_id":"sr-2edb8922c5da33cb621c4d334a0ffc29"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-1f28aac8b25f8f23bddb0cdaebce9665","url":"https://github.com/advisories/GHSA-c6mw-8xh8-gpq6","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-c6mw-8xh8-gpq6","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T02:20:52.377Z"},{"id":"sr-2edb8922c5da33cb621c4d334a0ffc29","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75912","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-75912","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-08T19:47:48.947Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-1f28aac8b25f8f23bddb0cdaebce9665"],"technology":"deepseek-tui","known_exclusions":[],"conditions_summary":"### Maintainer resolution\n\nThe CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below.\n\n# Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval\n\n## Overview\n\nThe `git_blame` tool in DeepSeek-TUI passes the model-supplied `rev` parameter unvalidated into the argv of `git blame`. `git blame` accepts `--contents=`, which causes it to use the file's contents in place of the working tree and echo each line verbatim in the blame output. A `rev` value of `--contents=/path/to/secret` therefore exfiltrates the targeted file's contents into the tool result, which is returned to the model and displayed in the chat transcript.\n\nThe tool is registered with `ApprovalRequirement::Auto` and declares `ToolCapability::ReadOnly`. The read is in-scope for the capability label, but the *target* of the read is not the user expects `git_blame` to read files inside the workspace, not arbitrary paths on the host.\n\nThis is a sibling of the `git_","public_affected_ranges":[">= 0.3.27, <= 0.8.41"]},{"certainty":"source_listed","source_ids":["sr-1f28aac8b25f8f23bddb0cdaebce9665"],"technology":"deepseek-tui","known_exclusions":[],"conditions_summary":"### Maintainer resolution\n\nThe CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below.\n\n# Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval\n\n## Overview\n\nThe `git_blame` tool in DeepSeek-TUI passes the model-supplied `rev` parameter unvalidated into the argv of `git blame`. `git blame` accepts `--contents=`, which causes it to use the file's contents in place of the working tree and echo each line verbatim in the blame output. A `rev` value of `--contents=/path/to/secret` therefore exfiltrates the targeted file's contents into the tool result, which is returned to the model and displayed in the chat transcript.\n\nThe tool is registered with `ApprovalRequirement::Auto` and declares `ToolCapability::ReadOnly`. The read is in-scope for the capability label, but the *target* of the read is not the user expects `git_blame` to read files inside the workspace, not arbitrary paths on the host.\n\nThis is a sibling of the `git_","public_affected_ranges":[">= 0.3.27, < 0.8.41"]},{"certainty":"source_listed","source_ids":["sr-1f28aac8b25f8f23bddb0cdaebce9665"],"technology":"codewhale-tui","known_exclusions":[],"conditions_summary":"### Maintainer resolution\n\nThe CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below.\n\n# Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval\n\n## Overview\n\nThe `git_blame` tool in DeepSeek-TUI passes the model-supplied `rev` parameter unvalidated into the argv of `git blame`. `git blame` accepts `--contents=`, which causes it to use the file's contents in place of the working tree and echo each line verbatim in the blame output. A `rev` value of `--contents=/path/to/secret` therefore exfiltrates the targeted file's contents into the tool result, which is returned to the model and displayed in the chat transcript.\n\nThe tool is registered with `ApprovalRequirement::Auto` and declares `ToolCapability::ReadOnly`. The read is in-scope for the capability label, but the *target* of the read is not the user expects `git_blame` to read files inside the workspace, not arbitrary paths on the host.\n\nThis is a sibling of the `git_","public_affected_ranges":[">= 0.8.41, < 0.8.64"]},{"certainty":"source_listed","source_ids":["sr-1f28aac8b25f8f23bddb0cdaebce9665"],"technology":"codewhale","known_exclusions":[],"conditions_summary":"### Maintainer resolution\n\nThe CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below.\n\n# Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval\n\n## Overview\n\nThe `git_blame` tool in DeepSeek-TUI passes the model-supplied `rev` parameter unvalidated into the argv of `git blame`. `git blame` accepts `--contents=`, which causes it to use the file's contents in place of the working tree and echo each line verbatim in the blame output. A `rev` value of `--contents=/path/to/secret` therefore exfiltrates the targeted file's contents into the tool result, which is returned to the model and displayed in the chat transcript.\n\nThe tool is registered with `ApprovalRequirement::Auto` and declares `ToolCapability::ReadOnly`. The read is in-scope for the capability label, but the *target* of the read is not the user expects `git_blame` to read files inside the workspace, not arbitrary paths on the host.\n\nThis is a sibling of the `git_","public_affected_ranges":[">= 0.8.41, < 0.8.64"]}],"null_published_at":"2026-11-08T19:53:44.046Z","source_updated_at":"2026-09-04T18:11:46.000Z","source_disclosed_at":"2026-09-04T18:11:45.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-02T02:20:52.377Z"},{"id":"NVI-00013929","kind":"vulnerability","title":"CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-c6mw-8xh8-gpq6","CVE-2026-75912"],"plain_summary":"GitHub lists this reviewed advisory for deepseek-tui, deepseek-tui, codewhale-tui, codewhale. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-1f28aac8b25f8f23bddb0cdaebce9665"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-04T18:11:46.000Z","value":"7.4 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-1f28aac8b25f8f23bddb0cdaebce9665"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-1f28aac8b25f8f23bddb0cdaebce9665","url":"https://github.com/advisories/GHSA-c6mw-8xh8-gpq6","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-c6mw-8xh8-gpq6","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T02:20:52.377Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-1f28aac8b25f8f23bddb0cdaebce9665"],"technology":"deepseek-tui","known_exclusions":[],"conditions_summary":"### Maintainer resolution\n\nThe CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below.\n\n# Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval\n\n## Overview\n\nThe `git_blame` tool in DeepSeek-TUI passes the model-supplied `rev` parameter unvalidated into the argv of `git blame`. `git blame` accepts `--contents=`, which causes it to use the file's contents in place of the working tree and echo each line verbatim in the blame output. A `rev` value of `--contents=/path/to/secret` therefore exfiltrates the targeted file's contents into the tool result, which is returned to the model and displayed in the chat transcript.\n\nThe tool is registered with `ApprovalRequirement::Auto` and declares `ToolCapability::ReadOnly`. The read is in-scope for the capability label, but the *target* of the read is not the user expects `git_blame` to read files inside the workspace, not arbitrary paths on the host.\n\nThis is a sibling of the `git_","public_affected_ranges":[">= 0.3.27, <= 0.8.41"]},{"certainty":"source_listed","source_ids":["sr-1f28aac8b25f8f23bddb0cdaebce9665"],"technology":"deepseek-tui","known_exclusions":[],"conditions_summary":"### Maintainer resolution\n\nThe CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below.\n\n# Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval\n\n## Overview\n\nThe `git_blame` tool in DeepSeek-TUI passes the model-supplied `rev` parameter unvalidated into the argv of `git blame`. `git blame` accepts `--contents=`, which causes it to use the file's contents in place of the working tree and echo each line verbatim in the blame output. A `rev` value of `--contents=/path/to/secret` therefore exfiltrates the targeted file's contents into the tool result, which is returned to the model and displayed in the chat transcript.\n\nThe tool is registered with `ApprovalRequirement::Auto` and declares `ToolCapability::ReadOnly`. The read is in-scope for the capability label, but the *target* of the read is not the user expects `git_blame` to read files inside the workspace, not arbitrary paths on the host.\n\nThis is a sibling of the `git_","public_affected_ranges":[">= 0.3.27, < 0.8.41"]},{"certainty":"source_listed","source_ids":["sr-1f28aac8b25f8f23bddb0cdaebce9665"],"technology":"codewhale-tui","known_exclusions":[],"conditions_summary":"### Maintainer resolution\n\nThe CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below.\n\n# Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval\n\n## Overview\n\nThe `git_blame` tool in DeepSeek-TUI passes the model-supplied `rev` parameter unvalidated into the argv of `git blame`. `git blame` accepts `--contents=`, which causes it to use the file's contents in place of the working tree and echo each line verbatim in the blame output. A `rev` value of `--contents=/path/to/secret` therefore exfiltrates the targeted file's contents into the tool result, which is returned to the model and displayed in the chat transcript.\n\nThe tool is registered with `ApprovalRequirement::Auto` and declares `ToolCapability::ReadOnly`. The read is in-scope for the capability label, but the *target* of the read is not the user expects `git_blame` to read files inside the workspace, not arbitrary paths on the host.\n\nThis is a sibling of the `git_","public_affected_ranges":[">= 0.8.41, < 0.8.64"]},{"certainty":"source_listed","source_ids":["sr-1f28aac8b25f8f23bddb0cdaebce9665"],"technology":"codewhale","known_exclusions":[],"conditions_summary":"### Maintainer resolution\n\nThe CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below.\n\n# Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval\n\n## Overview\n\nThe `git_blame` tool in DeepSeek-TUI passes the model-supplied `rev` parameter unvalidated into the argv of `git blame`. `git blame` accepts `--contents=`, which causes it to use the file's contents in place of the working tree and echo each line verbatim in the blame output. A `rev` value of `--contents=/path/to/secret` therefore exfiltrates the targeted file's contents into the tool result, which is returned to the model and displayed in the chat transcript.\n\nThe tool is registered with `ApprovalRequirement::Auto` and declares `ToolCapability::ReadOnly`. The read is in-scope for the capability label, but the *target* of the read is not the user expects `git_blame` to read files inside the workspace, not arbitrary paths on the host.\n\nThis is a sibling of the `git_","public_affected_ranges":[">= 0.8.41, < 0.8.64"]}],"null_published_at":"2026-11-02T10:00:37.175Z","source_updated_at":"2026-09-04T18:11:46.000Z","source_disclosed_at":"2026-09-04T18:11:45.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T02:20:52.377Z"}],"next_cursor":null,"snapshot_revision":"42594"}