CVE-2026-75915: CodeWhale 0.8.32 to before 0.8.41, 0.8.41 to before 0.8.64

CVE-2026-75915. EPSS 0.00678 (percentile 0.51723), scored 21-Oct-2026.

Affected technology

CodeWhale · 0.8.32 to before 0.8.41
Hmbown

CodeWhale · 0.8.41 to before 0.8.64
Hmbown

Description’s affected range: versions before 0.8.64

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API keys, cloud credentials, and authentication tokens back to the model context. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality impact as high; integrity and availability impact as none.

Published 23-Oct-2026 06:11 UTC

CWE: CWE-200
CCR priority: 0.2 /100 (P5)
EPSS: 0.00678 · percentile 0.51759 · 2026-10-22
KEV: no

Provenance

FIRST EPSS daily exploit-probability · Source record · observed 2026-10-23 06:11:59.600832+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-23 06:11:01.814928+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-75915.html