https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 10:34:01 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-355074 EUVD-2026-355074 https://cve.radiocsirt.org/vuln/euvd-2026-355074 https://cve.radiocsirt.org/vuln/fkie_cve-2026-75913 <p>CodeWhale (codewhale / codewhale-tui) versions &gt;= 0.8.41 and &lt; 0.8.64 contain an argument injection vulnerability in the git_show tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted as a git flag. Because the tool is registered as auto-approved and advertised as read-only, an attacker (via a malicious repository combined with prompt injection) can cause an unprompted arbitrary file write at the privilege of the invoking user, targeting sensitive files such as ~/.ssh/authorized_keys, ~/.bashrc, or ~/.gitconfig. Fixed in 0.8.64 by adding rev validation.</p> <p>CodeWhale (codewhale / codewhale-tui) versions &gt;= 0.8.41 and &lt; 0.8.64 contain an argument injection vulnerability in the git_show tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted as a git flag. Because the tool is registered as auto-approved and advertised as read-only, an attacker (via a malicious repository combined with prompt injection) can cause an unprompted arbitrary file write at the privilege of the invoking user, targeting sensitive files such as ~/.ssh/authorized_keys, ~/.bashrc, or ~/.gitconfig. Fixed in 0.8.64 by adding rev validation.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-75913 https://cve.radiocsirt.org/vuln/ghsa-7j5w-7r7x-9v27 <p><strong>Affected:</strong> crates.io: deepseek-tui, npm: deepseek-tui, crates.io: codewhale-tui, npm: codewhale</p> <p>### Maintainer resolution</p> <p>The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below.</p> <p># Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Approval</p> <p>## Overview</p> <p>The `git_show` tool in DeepSeek-TUI executes `git show` with the model-supplied `rev` parameter passed unvalidated into the argv. `git show` honours the `--output=&lt;path&gt;` option, so a `rev` value beginning with `--output=` is interpreted as a flag rather than a revision. The tool is registered with `ApprovalRequirement::Auto` and declares `ToolCapability::ReadOnly`, so the write happens without a user prompt and contradicts the capability the catalog advertises to the model and the user.</p> <p>This is the same vulnerability class as GHSA-72w5-pf8h-xfp4 (CVE-2026-45374): an auto-approved tool produces an effect outside the boundary the user consented to.</p> <p>## Impact</p> <p>A malicious repository combined with prompt injection, the threat model already documented in CVE-2026-45311 (auto-loaded `AGENTS.md` is treated as instructions by the model) yields an unprompted arbitrary file write at the privilege of the user running DeepSeek-TUI.</p> <p>Useful targets reachable as the invoking user:</p> <p>- `~/.ssh/authorized_keys` - `~/.bashrc`, `~/.zshrc`, `~/.profile` - `~/.gitconfig` (chainable…</p> <p><strong>Affected:</strong> crates.io: deepseek-tui, npm: deepseek-tui, crates.io: codewhale-tui, npm: codewhale</p> <p>### Maintainer resolution</p> <p>The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below.</p> <p># Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Approval</p> <p>## Overview</p> <p>The `git_show` tool in DeepSeek-TUI executes `git show` with the model-supplied `rev` parameter passed unvalidated into the argv. `git show` honours the `--output=&lt;path&gt;` option, so a `rev` value beginning with `--output=` is interpreted as a flag rather than a revision. The tool is registered with `ApprovalRequirement::Auto` and declares `ToolCapability::ReadOnly`, so the write happens without a user prompt and contradicts the capability the catalog advertises to the model and the user.</p> <p>This is the same vulnerability class as GHSA-72w5-pf8h-xfp4 (CVE-2026-45374): an auto-approved tool produces an effect outside the boundary the user consented to.</p> <p>## Impact</p> <p>A malicious repository combined with prompt injection, the threat model already documented in CVE-2026-45311 (auto-loaded `AGENTS.md` is treated as instructions by the model) yields an unprompted arbitrary file write at the privilege of the user running DeepSeek-TUI.</p> <p>Useful targets reachable as the invoking user:</p> <p>- `~/.ssh/authorized_keys` - `~/.bashrc`, `~/.zshrc`, `~/.profile` - `~/.gitconfig` (chainable…</p> https://cve.radiocsirt.org/vuln/ghsa-7j5w-7r7x-9v27