CVE-2026-75915: CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool that fa…
CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API keys, cloud credentials, and authentication tokens back to the model context.
- Published by source
- 2026-08-18
- First seen by Reality Radar
- 2026-10-23
- Last verified
- 2026-10-23
What the official notice says
Risk: CVSS 8.7
Is this affecting you?
Add what you own or use and Reality Radar will tell you when official changes match it — with evidence and next steps.
Sources
- NIST National Vulnerability Database Tier A · official published 2026-08-18
Evidence ledger
Every piece of evidence we store is appended to a public hash chain, so later edits are detectable. Anyone can re-verify it.
| Entry | Kind | Observed | Evidence hash | Entry hash |
|---|---|---|---|---|
| #1103 | new | 2026-10-23 | 7590d9928785…6a43fd | 269908f18b73…23cd19 |
Chain head: #1120 cad9b76f892d…f3f61c