CyberRota Analysis
AI-GeneratedCodeWhale versions prior to 0.8.64 are vulnerable due to an environment variable exposure in the js_execution tool, which does not adequately scrub parent process environment variables before initiating Node.js. This flaw allows attackers to execute crafted JavaScript code that can access and leak sensitive information such as API keys, cloud credentials, and authentication tokens. Organizations utilizing affected versions of CodeWhale should prioritize patching to mitigate the risk of credential exposure and potential unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API keys, cloud credentials, and authentication tokens back to the model context.