CVE-2026-75914

CodeWhale before 0.8.64 Path Traversal via image_analyze symlink

High8.7EPSS 0.53%

Published: 18 Aug 2026
Updated: 20 Aug 2026
Reserved: 18 Aug 2026
Assigned by: VulnCheck

Description

CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without user approval.

Timeline

2026
18 Aug 2026
18 Aug 2026
ID reserved
By VulnCheck
18 Aug 2026
18 Aug 2026
Published
20 Aug 20262 days later
20 Aug 2026· 2 days later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-75914, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	High8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
VulnCheckCNA (assigner)	3.1	High7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVDNVD · Deferred	4.0	High8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.53% · top 55% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.7.

Weakness

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (opens in a new tab)All about CWE-22 and its CVEs

Affected products

Hmbown · CodeWhale
- affected 0.8.32 – < 0.8.41
- unaffected 0.8.41
Hmbown · CodeWhale
- affected 0.8.32 – < 0.8.41
- unaffected 0.8.41
Hmbown · CodeWhale
- affected 0.8.41 – < 0.8.64
- unaffected 0.8.64
Hmbown · CodeWhale
- affected 0.8.41 – < 0.8.64
- unaffected 0.8.64

Affected packages

From reviewed advisories of the GitHub Advisory Database.

crates.iocodewhale-tuiGHSA-w7wx-5q49-r59w (opens in a new tab)
crates.iodeepseek-tuiGHSA-w7wx-5q49-r59w (opens in a new tab)
npmcodewhaleGHSA-w7wx-5q49-r59w (opens in a new tab)
npmdeepseek-tuiGHSA-w7wx-5q49-r59w (opens in a new tab)

References (3)

GitHub Security Advisory (GHSA-w7wx-5q49-r59w) (opens in a new tab)vendor-advisory
Patch Commit (opens in a new tab)patch
VulnCheck Advisory: CodeWhale before 0.8.64 Path Traversal via image_analyze symlink (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-75914](https://trackcve.app/badge/CVE-2026-75914.svg)](https://trackcve.app/cve/CVE-2026-75914)

Record last updated 20 Aug 2026, 15:24 UTC.