CyberRota Analysis
AI-GeneratedCodeWhale versions prior to 0.8.64 are vulnerable due to inadequate validation of file paths in the project configuration, enabling attackers to read arbitrary files from the victim's system. This flaw can be exploited through a malicious .codewhale/config.toml file in a cloned repository, potentially leading to sensitive data exfiltration. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized data access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and injected into the AI system prompt for exfiltration.