CyberRota Analysis
AI-GeneratedCodeWhale versions prior to 0.8.64 are vulnerable to an argument injection flaw in the git_blame tool, enabling attackers to manipulate the unvalidated rev parameter to read arbitrary files. This vulnerability allows for the exfiltration of sensitive information, including SSH keys and credentials, through crafted git options. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized data access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files such as SSH keys and credentials through the tool output returned to the model.