CVE-2026-75912 is an argument injection vulnerability in Hmbown's CodeWhale product, specifically in the git_blame tool. Versions prior to 0.8.64 improperly neutralize argument delimiters in the rev parameter, allowing attackers to inject git options like --contents=/path/to/file. This injection enables unauthorized reading of arbitrary files, including sensitive data such as SSH keys and credentials, via the tool's output. The vulnerability requires no privileges and no user interaction but has high impact on confidentiality.

Successful exploitation allows an unauthenticated attacker to read arbitrary files on the system running CodeWhale, potentially exposing sensitive information such as SSH keys and credentials. This compromises confidentiality and could lead to further system compromise if the leaked credentials are used maliciously.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using affected versions or restrict access to the git_blame tool to trusted users only.