CVE-2026-75859 is a path traversal vulnerability in Hmbown's CodeWhale product affecting versions before 0.8.64. The vulnerability arises because the software fails to properly validate file paths specified in the project config instructions field. An attacker can craft a malicious .codewhale/config.toml file in a cloned repository that references files outside the intended workspace. These files are then read and injected into the AI system prompt, potentially leading to unauthorized data disclosure.

Successful exploitation allows an unauthenticated attacker to read arbitrary files on the victim's system without user interaction, resulting in high confidentiality impact. This could expose sensitive information contained in files outside the workspace.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time.