CodeWhale versions before 0.8.64 have an argument injection flaw in the git_blame tool. The unvalidated "rev" parameter accepts arbitrary git options, allowing an attacker to provide values such as "--contents=/path/to/file". This causes git to output the contents of the specified file, which is then returned through the tool’s output. Sensitive data such as SSH keys and credentials can thus be exposed. The flaw enables read access to any file path that the executing user can reach, leading to confidentiality compromise.

The vulnerability affects Hmbown’s CodeWhale software, all releases prior to version 0.8.64. Any installation of this product that has not been upgraded to 0.8.64 or later is susceptible.

With a CVSS score of 8.3 the vulnerability is considered high severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog, but the lack of availability does not diminish the risk. The likely attack vector requires an attacker who can influence the "rev" input – for example, a user who can trigger git_blame within the application or a compromised local user with permission to run the tool. If such influence is possible, the attacker could read arbitrary files, potentially leading to credential theft or further lateral movement.