CVE-2026-75914: CodeWhale before 0.8.64 Path Traversal via image_analyze symlink

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-18 · updated 2026-10-22
Weakness: CWE-22

Description

CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without user approval.

Affected products

Hmbown CodeWhale: from 0.8.32 before 0.8.41; from 0.8.41 before 0.8.64 — fixed in 0.8.41, 0.8.64

How to fix

Upgrade to a fixed version: Hmbown CodeWhale 0.8.41, 0.8.64. Check the vendor advisory for mitigations.

References

https://github.com/Hmbown/CodeWhale/commit/26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e
https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-w7wx-5q49-r59w
https://www.vulncheck.com/advisories/codewhale-before-path-traversal-via-image-analyze-symlink

Get alerted when CVE-2026-75914 or the next vulnerability affects your stack