CVE-2026-75915 describes an environment variable exposure vulnerability in Hmbown's CodeWhale product, specifically in versions before 0.8.64. The vulnerability exists in the js_execution tool, which fails to clear parent process environment variables before launching a Node.js process. An attacker who can execute crafted JavaScript code via this tool can read the process.env object, thereby accessing sensitive information like API keys and authentication tokens. This exposure can lead to unauthorized disclosure of credentials and secrets within the affected environment.

An attacker exploiting this vulnerability can obtain sensitive environment variables including API keys, cloud credentials, and authentication tokens without any privileges or user interaction. This can lead to unauthorized access to protected resources and compromise of the affected system or services relying on these credentials. The CVSS 4.0 base score is 8.7, indicating a high severity vulnerability with network attack vector, no required privileges or user interaction, and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid running untrusted JavaScript code in the js_execution tool or restrict its usage to trusted users only. Monitor for updates from Hmbown regarding patches or mitigations for this vulnerability.