CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes
- Product
- CodeWhale
- CVE
- CVE-2026-75914
- Affected
- rust/deepseek-tui >= 0.8.32, <= 0.8.41; npm/deepseek-tui >= 0.8.32, < 0.8.41; rust/codewhale-tui >= 0.8.41, < 0.8.64; npm/codewhale >= 0.8.41, < 0.8.64
- Fixed in
- 0.8.41
Last verified against sources: October 26, 2026
Am I affected?
CodeWhale: affected rust/deepseek-tui >= 0.8.32, <= 0.8.41; npm/deepseek-tui >= 0.8.32, < 0.8.41; rust/codewhale-tui >= 0.8.41, < 0.8.64; npm/codewhale >= 0.8.41, < 0.8.64. Fixed in 0.8.41.
- Check your version: run
cargo tree -i deepseek-tui. Versions >= 0.8.32, <= 0.8.41 of deepseek-tui are affected. [1] - Check your version: run
npm ls deepseek-tui. Versions >= 0.8.32, < 0.8.41 of deepseek-tui are affected. [1] - Check your version: run
cargo tree -i codewhale-tui. Versions >= 0.8.41, < 0.8.64 of codewhale-tui are affected. [1]
What to do now
- Upgrade to the fixed version: run
npm install deepseek-tui@0.8.41(first patched version 0.8.41). [1] - Upgrade to the fixed version: run
cargo update -p codewhale-tui --precise 0.8.64(first patched version 0.8.64). [1] - Upgrade to 0.8.64 or later. [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- image_analyze follows workspace symlinks and leaks outside-workspace file bytes to the vision endpoint. [1]
- The image_analyze tool resolves its image_path with a bare context.workspace.join instead of routing through ToolContext::resolve_path. [1]
- The tool has ReadOnly capability and the trait default makes it auto-approved, so the bypass executes with no user prompt. [1]
Impact
- A workspace symlink whose name ends in .png, .jpg, .jpeg, .gif, .webp, or .bmp and whose target sits outside the workspace becomes a read primitive that the model can invoke without an approval prompt. [1]
- The file bytes are base64-encoded into the image_url.url field of the chat-completion payload and POSTed to the configured vision endpoint along with the user's bearer token. [1]
- The vision provider receives every byte of the target file in plaintext. [1]
- A prompt-injection delivered through a poisoned README, fetched web page, or MCP server output can issue {"image_path": "screenshot.png"} and the bytes leave the machine on the same turn without any visible UI cue. [1]
What was done
Sources
- GHSA-w7wx-5q49-r59w — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
[CVE-2026-75914] CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes
Product: CodeWhale | Affected: rust/deepseek-tui >= 0.8.32, <= 0.8.41; npm/deepseek-tui >= 0.8.32, < 0.8.41; rust/codewhale-tui >= 0.8.41, < 0.8.64; npm/codewhale >= 0.8.41, < 0.8.64 | Fixed in: 0.8.41
Summary: image_analyze follows workspace symlinks and leaks outside-workspace file bytes to the vision endpoint.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/09/cve-2026-75914-codewhaleCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for CVE-2026-75914
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.