Loading vulnerability…
CVE-2026-75912 is an argument-injection vulnerability in CodeWhale versions before 0.8.64 affecting the GitBlameTool and GitShowTool execution paths. The tools pass the attacker-controlled revision parameter to system Git commands without sufficient validation or reliable termination of Git option parsing. A supplied revision beginning with an option delimiter can therefore be interpreted as a Git option rather than a revision, including options that cause Git to load locally readable content and return it in tool output. The resulting output is placed into the AI model context.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An argument-injection vulnerability in CodeWhale/DeepSeek-TUI's git_blame tool that permits arbitrary host-file reads accessible to the invoking user. An attacker can supply Git options through the unvalidated rev parameter, notably --contents=<file>; because the tool auto-approves execution, malicious repository content and prompt injection can cause sensitive file contents to be returned to the model and chat transcript.
An option-injection vulnerability in CodeWhale's GitShowTool and GitBlameTool execution paths. Unvalidated revision (rev) input can be interpreted as a git command-line option, enabling reads of local files such as /etc/passwd and returning their contents to the AI context. The provided patch adds validation that rejects empty revisions, leading hyphens, and control characters.
An argument injection vulnerability in CodeWhale's git_blame tool that allows arbitrary file read and exfiltration via unvalidated rev parameter input.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.