What’s Vulnerable › Vulnerabilities

CVE-2026-75915: CodeWhale before 0.8.64 Environment Variable Leak via js_execution

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-18 · updated 2026-10-22
• Weakness: CWE-200

Description

CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API keys, cloud credentials, and authentication tokens back to the model context.

Affected products

• Hmbown CodeWhale: from 0.8.32 before 0.8.41; from 0.8.41 before 0.8.64 — fixed in 0.8.41, 0.8.64

How to fix

Upgrade to a fixed version: Hmbown CodeWhale 0.8.41, 0.8.64. Check the vendor advisory for mitigations.

References

• https://github.com/Hmbown/CodeWhale/commit/26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e
• https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-h539-c7r8-3xq4
• https://www.vulncheck.com/advisories/codewhale-before-environment-variable-leak-via-js-execution
• https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-h539-c7r8-3xq4

Get alerted when CVE-2026-75915 or the next vulnerability affects your stack