# codewhale (npm) vulnerabilities 9 known vulnerabilities (1 critical, 8 high), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 0.10.2 (Oct 24, 2026): no advisory affects it - Newest unaffected release: 0.10.2 (Oct 24, 2026), the latest release - Weekly downloads: 5,601 - Dependents: 0 - Releases: 39 since 0.8.41 (May 23, 2026) - Registry: https://www.npmjs.com/package/codewhale - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-75915: 0.8.41 to 0.8.63 (0.8.64 is outside it) - CVE-2026-75914: 0.8.41 to 0.8.63 (0.8.64 is outside it) - CVE-2026-75913: 0.8.41 to 0.8.63 (0.8.64 is outside it) - CVE-2026-75912: 0.8.41 to 0.8.63 (0.8.64 is outside it) - CVE-2026-75911: 0.8.41 to 0.8.63 (0.8.64 is outside it) - CVE-2026-75859: 0.8.41 to 0.8.63 (0.8.64 is outside it) - CVE-2026-75858: 0.8.41 to 0.8.63 (0.8.64 is outside it) - CVE-2026-75857: 0.8.41 to 0.8.63 (0.8.64 is outside it) - CVE-2026-75856: 0.8.41 to 0.8.63 (0.8.64 is outside it) ## Advisories (9) ### [CVE-2026-75915](https://cve.now/CVE-2026-75915): CodeWhale before 0.8.64 Environment Variable Leak via js\_execution - Severity: High 8.7 - Published: Aug 18, 2026 - Affected: from 0.8.41, fixed in 0.8.64. - Fixed in 0.8.64 (released Jun 23, 2026, 56 days before disclosure). - The latest release, 0.10.2, is not affected. - 1% of codewhale downloads last week were affected versions (49). ### [CVE-2026-75914](https://cve.now/CVE-2026-75914): CodeWhale before 0.8.64 Path Traversal via image\_analyze symlink - Severity: High 8.7 - Published: Aug 18, 2026 - Affected: from 0.8.41, fixed in 0.8.64. - Fixed in 0.8.64 (released Jun 23, 2026, 56 days before disclosure). - The latest release, 0.10.2, is not affected. - 1% of codewhale downloads last week were affected versions (49). ### [CVE-2026-75913](https://cve.now/CVE-2026-75913): CodeWhale before 0.8.64 Argument Injection via git\_show - Severity: High 8.5 - Published: Aug 18, 2026 - Affected: from 0.8.41, fixed in 0.8.64. - Fixed in 0.8.64 (released Jun 23, 2026, 56 days before disclosure). - The latest release, 0.10.2, is not affected. - 1% of codewhale downloads last week were affected versions (49). ### [CVE-2026-75912](https://cve.now/CVE-2026-75912): CodeWhale before 0.8.64 Argument Injection via git\_blame - Severity: High 8.3 - Published: Aug 18, 2026 - Affected: from 0.8.41, fixed in 0.8.64. - Fixed in 0.8.64 (released Jun 23, 2026, 56 days before disclosure). - The latest release, 0.10.2, is not affected. - 1% of codewhale downloads last week were affected versions (49). ### [CVE-2026-75911](https://cve.now/CVE-2026-75911): CodeWhale before 0.8.64 Remote Code Execution via allow\_shell - Severity: High 8.5 - Published: Aug 18, 2026 - Affected: from 0.8.41, fixed in 0.8.64. - Fixed in 0.8.64 (released Jun 23, 2026, 56 days before disclosure). - The latest release, 0.10.2, is not affected. - 1% of codewhale downloads last week were affected versions (49). ### [CVE-2026-75859](https://cve.now/CVE-2026-75859): CodeWhale before 0.8.64 Arbitrary File Read via instructions - Severity: High 8.7 - Published: Aug 18, 2026 - Affected: from 0.8.41, fixed in 0.8.64. - Fixed in 0.8.64 (released Jun 23, 2026, 56 days before disclosure). - The latest release, 0.10.2, is not affected. - 1% of codewhale downloads last week were affected versions (49). ### [CVE-2026-75858](https://cve.now/CVE-2026-75858): CodeWhale rlm\_eval before 0.8.64 Remote Code Execution - Severity: High 8.5 - Published: Aug 18, 2026 - Affected: from 0.8.41, fixed in 0.8.64. - Fixed in 0.8.64 (released Jun 23, 2026, 56 days before disclosure). - The latest release, 0.10.2, is not affected. - 1% of codewhale downloads last week were affected versions (49). ### [CVE-2026-75857](https://cve.now/CVE-2026-75857): CodeWhale before 0.8.64 Privilege Escalation via exec\_shell\_interact - Severity: High 7.3 - Published: Aug 18, 2026 - Affected: from 0.8.41, fixed in 0.8.64. - Fixed in 0.8.64 (released Jun 23, 2026, 56 days before disclosure). - The latest release, 0.10.2, is not affected. - 1% of codewhale downloads last week were affected versions (49). ### [CVE-2026-75856](https://cve.now/CVE-2026-75856): CodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOU - Severity: Critical 9.2 - Published: Aug 18, 2026 - Affected: from 0.8.41, fixed in 0.8.64. - Fixed in 0.8.64 (released Jun 23, 2026, 56 days before disclosure). - The latest release, 0.10.2, is not affected. - 1% of codewhale downloads last week were affected versions (49). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/codewhale Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.