CodeWhale (codewhale / codewhale-tui) versions >=0.8.41 and <0.8.64 have an argument injection vulnerability in the git_show tool. The rev parameter, supplied by the model, is passed directly into the git show argv without an --end-of-options sentinel, allowing values starting with --output= to be interpreted as git flags. Since the tool is auto-approved and advertised as read-only, an attacker can exploit this via a malicious repository combined with prompt injection to cause an unprompted arbitrary file write with the privileges of the invoking user. This can target sensitive files such as ~/.ssh/authorized_keys, ~/.bashrc, or ~/.gitconfig. The vulnerability is fixed in version 0.8.64 by adding validation to the rev parameter.

An attacker can cause arbitrary file writes on the system with the privileges of the user running CodeWhale. This can lead to overwriting critical configuration or authentication files, potentially enabling further compromise or persistence. The vulnerability does not require privileges or user interaction beyond invoking the vulnerable tool with a crafted repository and prompt injection.

A fix is available in CodeWhale version 0.8.64, which adds validation of the rev parameter to prevent argument injection. Users should upgrade to version 0.8.64 or later to remediate this vulnerability. No other official remediation or temporary fixes are documented. Patch status is not explicitly confirmed beyond the fix in 0.8.64; users should verify with vendor advisories.