CVE-2026-75859

CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and injected into the AI system prompt for exfiltration.

CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and injected into the AI system prompt for exfiltration.

Maintainer resolution

The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 43563356b98c6b993085554da82e77370160a31c. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below.

Summary

A malicious .codewhale/config.toml or .deepseek/config.toml committed to a repository can set instructions to an array of arbitrary file paths (including paths outside the workspace like ~/.ssh/id_rsa or ~/.aws/credentials) that are read from disk and injected into the AI model's system prompt. There is no path validation, workspace boundary check, or tightening guard on the instructions field. This enables a malicious repository to exfiltrate the contents of sensitive files on the victim's machine through the AI conversation.

Details

The project config merge function at crates/tui/src/main.rs:5190-5197 (v0.8.50) copies the instructions array from a project-level config file into the live session config without any path validation:

if let Some(arr) = table.get("instructions").and_then(toml::Value::as_array) {
    let entries: Vec<String> = arr
        .iter()
        .filter_map(|v| v.as_str().map(str::to_string))
        .filter(|s| !s.trim().is_empty())
        .collect();
    config.instructions = Some(entries);
}

These paths are then resolved via expand_path at crates/tui/src/config.rs:2361-2371, which expands ~ to the user's home directory and resolves environment variables:

pub fn instructions_paths(&self) -> Vec<PathBuf> {
    self.instructions.as_deref().unwrap_or(&[])
        .iter()
        .map(String::as_str)
        .map(str::trim)
        .filter(|s| !s.is_empty())
        .map(expand_path)
        .collect()
}

The resolved paths are loaded at prompt-render time in crates/tui/src/prompts.rs:216 with no workspace boundary check:

InstructionSource::File(path) => match std::fs::read_to_string(path) {
    Ok(raw) => (path.display().to_string(), raw),
    ...
}

The file contents are injected into the AI system prompt at crates/tui/src/prompts.rs:243-245:

sections.push(format!(
    "<instructions source=\"{raw_source_name}\">\n{body}\n</instructions>"
));

Source of attacker-controlled input: The .codewhale/config.toml or .deepseek/config.toml file in a cloned repository, specifically the instructions array.

Security boundary crossed: Workspace isolation. The resolve_path function in crates/tui/src/tools/spec.rs:360-466 enforces workspace boundaries for file tools, but the instructions loading path has no such boundary check.

Sink reached: The contents of arbitrary files are placed into the AI model's system prompt, making them available to the model and potentially exfiltratable through conversation responses.

Why existing mitigations do not prevent exploitation:

1. The INSTRUCTIONS_FILE_MAX_BYTES cap at crates/tui/src/prompts.rs:70 limits each file to 100KB but does not prevent reading sensitive files (SSH keys, AWS credentials, .env files are all well under 100KB).
2. The DENY_AT_PROJECT_SCOPE list at crates/tui/src/main.rs:5119 blocks api_key, base_url, provider, and mcp_config_path but does not block instructions.
3. Unlike approval_policy and sandbox_mode, there is no tightening guard for instructions.
4. The expand_path function at crates/tui/src/config.rs:2805 actively expands ~ and environment variables, making it easier to target known sensitive file locations.

Flow from source to sink:

1. User clones a repository containing .codewhale/config.toml with instructions = ["~/.ssh/id_rsa"]
2. User runs codewhale in the repository directory
3. merge_project_config() reads the project config and sets config.instructions = Some(["~/.ssh/id_rsa"])
4. config.instructions_paths() calls expand_path on each entry, resolving…

CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and injected into the AI system prompt for exfiltration.

CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and injected into the AI system prompt for exfiltration.

Maintainer resolution

The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 43563356b98c6b993085554da82e77370160a31c. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below.

Summary

A malicious .codewhale/config.toml or .deepseek/config.toml committed to a repository can set instructions to an array of arbitrary file paths (including paths outside the workspace like ~/.ssh/id_rsa or ~/.aws/credentials) that are read from disk and injected into the AI model's system prompt. There is no path validation, workspace boundary check, or tightening guard on the instructions field. This enables a malicious repository to exfiltrate the contents of sensitive files on the victim's machine through the AI conversation.

Details

The project config merge function at crates/tui/src/main.rs:5190-5197 (v0.8.50) copies the instructions array from a project-level config file into the live session config without any path validation:

if let Some(arr) = table.get("instructions").and_then(toml::Value::as_array) {
    let entries: Vec<String> = arr
        .iter()
        .filter_map(|v| v.as_str().map(str::to_string))
        .filter(|s| !s.trim().is_empty())
        .collect();
    config.instructions = Some(entries);
}

These paths are then resolved via expand_path at crates/tui/src/config.rs:2361-2371, which expands ~ to the user's home directory and resolves environment variables:

pub fn instructions_paths(&self) -> Vec<PathBuf> {
    self.instructions.as_deref().unwrap_or(&[])
        .iter()
        .map(String::as_str)
        .map(str::trim)
        .filter(|s| !s.is_empty())
        .map(expand_path)
        .collect()
}

The resolved paths are loaded at prompt-render time in crates/tui/src/prompts.rs:216 with no workspace boundary check:

InstructionSource::File(path) => match std::fs::read_to_string(path) {
    Ok(raw) => (path.display().to_string(), raw),
    ...
}

The file contents are injected into the AI system prompt at crates/tui/src/prompts.rs:243-245:

sections.push(format!(
    "<instructions source=\"{raw_source_name}\">\n{body}\n</instructions>"
));

Source of attacker-controlled input: The .codewhale/config.toml or .deepseek/config.toml file in a cloned repository, specifically the instructions array.

Security boundary crossed: Workspace isolation. The resolve_path function in crates/tui/src/tools/spec.rs:360-466 enforces workspace boundaries for file tools, but the instructions loading path has no such boundary check.

Sink reached: The contents of arbitrary files are placed into the AI model's system prompt, making them available to the model and potentially exfiltratable through conversation responses.

Why existing mitigations do not prevent exploitation:

1. The INSTRUCTIONS_FILE_MAX_BYTES cap at crates/tui/src/prompts.rs:70 limits each file to 100KB but does not prevent reading sensitive files (SSH keys, AWS credentials, .env files are all well under 100KB).
2. The DENY_AT_PROJECT_SCOPE list at crates/tui/src/main.rs:5119 blocks api_key, base_url, provider, and mcp_config_path but does not block instructions.
3. Unlike approval_policy and sandbox_mode, there is no tightening guard for instructions.
4. The expand_path function at crates/tui/src/config.rs:2805 actively expands ~ and environment variables, making it easier to target known sensitive file locations.

Flow from source to sink:

1. User clones a repository containing .codewhale/config.toml with instructions = ["~/.ssh/id_rsa"]
2. User runs codewhale in the repository directory
3. merge_project_config() reads the project config and sets config.instructions = Some(["~/.ssh/id_rsa"])
4. config.instructions_paths() calls expand_path on each entry, resolving…