CodeWhale: js_execution leaks parent environment to model context via missing env scrub
- Product
- CodeWhale
- CVE
- CVE-2026-75915
- Affected
- rust/deepseek-tui >= 0.8.32, <= 0.8.41; npm/deepseek-tui >= 0.8.32, < 0.8.41; rust/codewhale-tui >= 0.8.41, < 0.8.64; npm/codewhale >= 0.8.41, < 0.8.64
- Fixed in
- 0.8.64
Last verified against sources: October 26, 2026
Am I affected?
CodeWhale: affected rust/deepseek-tui >= 0.8.32, <= 0.8.41; npm/deepseek-tui >= 0.8.32, < 0.8.41; rust/codewhale-tui >= 0.8.41, < 0.8.64; npm/codewhale >= 0.8.41, < 0.8.64. Fixed in 0.8.64.
- Check your version: run
cargo tree -i deepseek-tui. Versions >= 0.8.32, <= 0.8.41 of deepseek-tui are affected. [1] - Check your version: run
npm ls deepseek-tui. Versions >= 0.8.32, < 0.8.41 of deepseek-tui are affected. [1] - Check your version: run
cargo tree -i codewhale-tui. Versions >= 0.8.41, < 0.8.64 of codewhale-tui are affected. [1]
What to do now
- Upgrade to the fixed version: run
npm install deepseek-tui@0.8.41(first patched version 0.8.41). [1] - Upgrade to the fixed version: run
cargo update -p codewhale-tui --precise 0.8.64(first patched version 0.8.64). [1] - Upgrade to 0.8.64 or later. [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- The js_execution tool spawns Node with tokio::process::Command::new without calling the child_env scrubber that exec_shell, the Python REPL, and the MCP launcher all use. [1]
- Model-provided JavaScript reads process.env and the values flow back to the parent transcript as the tool's stdout, exposing API keys, cloud credentials, and forge tokens to the next model turn. [1]
- The Command is built without
cmd.env_clear()and without the project'scrate::child_env::apply_to_tokio_commandhelper. [1] - Every variable in the parent process environment is inherited by the spawned
node. [1]
Impact
- The tool returns parent-environment secrets to the model on a single approval, or with no approval in YOLO mode. [1]
- Any variable the user has exported becomes part of the next model request and travels to the configured LLM provider's logs. [1]
- In YOLO mode (
auto_approve=true) the JS body runs without any prompt at all, so a single adversarial prompt-injection from a README, fetched web page, or MCP server output drains the parent environment to the next model turn. [1] - The local-sandbox wording shown at approval time understates the trust boundary, so users approving what they read as a sandboxed snippet do not anticipate that every shell-exported credential is reachable from the snippet. [1]
What was done
Sources
- GHSA-h539-c7r8-3xq4 — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
[CVE-2026-75915] CodeWhale: js_execution leaks parent environment to model context via missing env scrub
Product: CodeWhale | Affected: rust/deepseek-tui >= 0.8.32, <= 0.8.41; npm/deepseek-tui >= 0.8.32, < 0.8.41; rust/codewhale-tui >= 0.8.41, < 0.8.64; npm/codewhale >= 0.8.41, < 0.8.64 | Fixed in: 0.8.64
Summary: The js_execution tool spawns Node with tokio::process::Command::new without calling the child_env scrubber that exec_shell, the Python REPL, and the MCP launcher all use.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/09/cve-2026-75915-codewhaleCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for CVE-2026-75915
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.