https://vulnerability.circl.lu/sightings/feed 2026-10-02T17:19:56.578689+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/7027a16f-f7e8-4b30-b3b7-e4c5ce60cd6b/export 2026-10-02T17:19:56.597733+00:00 Joseph Lee https://cvepremium.circl.lu/user/syspect {"uuid": "7027a16f-f7e8-4b30-b3b7-e4c5ce60cd6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-75914", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-w7wx-5q49-r59w", "content": "", "creation_timestamp": "2026-09-04T18:35:04.152443Z"} 2026-09-04T18:35:04.152443+00:00 https://vulnerability.circl.lu/sighting/504d0b19-a99f-4f47-9575-ab6a2f47397e/export 2026-10-02T17:19:56.599724+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "504d0b19-a99f-4f47-9575-ab6a2f47397e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75914", "type": "seen", "source": "https://gist.github.com/alon710/5450dc0367b1b3821398b1bbcad341e1", "content": "# CVE-2026-75914: CVE-2026-75914: Improper Link Resolution and Path Traversal in CodeWhale image_analyze Tool\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-75914\n\n## Summary\nAn improper link resolution vulnerability (CWE-59) in the image_analyze tool of CodeWhale allows remote attackers to traverse directories (CWE-22) and leak sensitive local files via symlink manipulation.\n\n## TL;DR\nCodeWhale versions prior to 0.8.64 are vulnerable to a path traversal attack. By introducing a symbolic link inside the agent workspace that points to a sensitive host file but naming it with an image extension, attackers can force the image_analyze tool to read the target file, encode its contents, and leak them directly to a vision LLM endpoint without user consent.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **Primary CWE ID**: CWE-22\n- **Secondary CWE ID**: CWE-59\n- **Attack Vector**: Network\n- **CVSS v4.0 Base Score**: 8.7 (High)\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- CodeWhale Terminal Coding Agent\n- **CodeWhale**: >= 0.8.32, < 0.8.64 (Fixed in: `0.8.64`)\n\n## Mitigation\n\n- Upgrade CodeWhale to version 0.8.64 or higher to enforce canonicalized path validation.\n- Run autonomous agents inside containerized, sandboxed environments with read-only filesystems.\n- Restrict network outbound access of the agent to trusted LLM endpoints to limit data exfiltration paths.\n\n**Remediation Steps:**\n1. Identify all installations of CodeWhale in local development and production environments.\n2. For Cargo-based installations, execute: cargo install codewhale --version 0.8.64 --force\n3. Scan existing workspace directories for out-of-boundary symbolic links using automated find scripts.\n\n## References\n\n- [GitHub Security Advisory GHSA-w7wx-5q49-r59w](https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-w7wx-5q49-r59w)\n- [VulnCheck Advisory for CodeWhale](https://www.vulncheck.com/advisories/codewhale-before-path-traversal-via-image-analyze-symlink)\n- [NVD CVE-2026-75914 Record](https://nvd.nist.gov/vuln/detail/CVE-2026-75914)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-75914) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T18:32:13.557784Z"} 2026-09-04T18:32:13.557784+00:00 https://vulnerability.circl.lu/sighting/74777d73-94f9-4caa-b995-eaabafab4ffb/export 2026-10-02T17:19:56.600357+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "74777d73-94f9-4caa-b995-eaabafab4ffb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75914", "type": "seen", "source": "https://bsky.app/profile/thestandup.bsky.social/post/3mupk5nd6d22k", "content": "CVE-2026-75914, rated high, in deepseek-tui: its image_analyze tool follows symlinks inside the workspace, so a linked path outside it gets read and its bytes sent to the vision endpoint. The maintainers validated the report; 0.8.64 carries the fix. #dev", "creation_timestamp": "2026-09-04T17:59:23.397274Z"} 2026-09-04T17:59:23.397274+00:00 https://vulnerability.circl.lu/sighting/1a06e03b-1be5-4dd5-82ee-392eacf62897/export 2026-10-02T17:19:56.600435+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "1a06e03b-1be5-4dd5-82ee-392eacf62897", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75914", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/7zntx7kh7mho3", "content": "CVE-2026-75914 - CodeWhale before 0.8.64 Path Traversal via image_analyze symlink\nCVE ID : CVE-2026-75914\n \n Published : Aug. 18, 2026, 3:22 p.m. | 51\u00a0minutes ago\n \n Description : CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool...", "creation_timestamp": "2026-08-18T16:33:37.578602Z"} 2026-08-18T16:33:37.578602+00:00