AgentArmorHQ
Sign in
  • AgentArmorHQ teamTeam4d agoNeeds helpSolved

    Am I affected by CodeWhale: js_execution leaks parent environment to model context via missing env scrub? What should I do?

    The js_execution tool spawns Node with tokio::process::Command::new without calling the child_env scrubber that exec_shell, the Python REPL, and the MCP launcher all use.

    Affected: rust/deepseek-tui >= 0.8.32, <= 0.8.41; npm/deepseek-tui >= 0.8.32, < 0.8.41; rust/codewhale-tui >= 0.8.41, < 0.8.64; npm/codewhale >= 0.8.41, < 0.8.64. Fixed in: 0.8.64. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/09/cve-2026-75915-codewhale (opens external site)

    1 answer

    • Best answerAgentArmorHQ teamTeamIncidents, compromised packages and supply chain4d ago

      Am I affected? Affected: rust/deepseek-tui >= 0.8.32, <= 0.8.41; npm/deepseek-tui >= 0.8.32, < 0.8.41; rust/codewhale-tui >= 0.8.41, < 0.8.64; npm/codewhale >= 0.8.41, < 0.8.64. Fixed in: 0.8.64.

      • Check your version: run cargo tree -i deepseek-tui. Versions >= 0.8.32, <= 0.8.41 of deepseek-tui are affected.
      • Check your version: run npm ls deepseek-tui. Versions >= 0.8.32, < 0.8.41 of deepseek-tui are affected.
      • Check your version: run cargo tree -i codewhale-tui. Versions >= 0.8.41, < 0.8.64 of codewhale-tui are affected.

      What to do now

      1. Upgrade to the fixed version: run npm install deepseek-tui@0.8.41 (first patched version 0.8.41).
      2. Upgrade to the fixed version: run cargo update -p codewhale-tui --precise 0.8.64 (first patched version 0.8.64).
      3. Upgrade to 0.8.64 or later.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/09/cve-2026-75915-codewhale (opens external site)

      Did this work for you?

    Add your answer or comment