The flaw is an argument injection in CodeWhale's git_show utility. The model supplied rev value is forwarded to the git command without validation or an end‑of‑options sentinel, so a string beginning with --output= is treated as an option by git. Because the tool is presented as read‑only and automatically trusted, an attacker can influence the rev value via a malicious CodeWhale repository combined with prompt injection. This can lead to unprompted arbitrary writes at the privilege of the user running CodeWhale, such as to ~/.ssh/authorized_keys, ~/.bashrc, or ~/.gitconfig.

Versions from CodeWhale 0.3.27 through 0.8.63 are affected. The vulnerable components are the codewhale, codewhale‑tui, and deepseek‑tui packages distributed on npm, crates.io, and GitHub. The default affected editions include deepseek‑tui >= 0.3.27 and < 0.8.41, and codewhale / codewhale‑tui >= 0.8.41 and < 0.8.64.

The CVSS score of 8.5 indicates high severity, but the EPSS score of < 1% shows that exploitation is expected to be rare. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to supply a crafted rev string, which is only possible if the git_show command is executed with untrusted input from a repository that the user trusts. The lack of an end‑of‑options sentinel and the ability to write arbitrary files poses a significant risk if the conditions are met, but the low EPSS score suggests a low probability of widespread attacks at present.