Labs
Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.
- highCVE-2026-75859
CVE-2026-75859: deepseek-tui (CodeWhale) Arbitrary File Read via Project Config instructions Override
A malicious repository can commit a config file that points CodeWhale's instructions field at sensitive files outside the project, causing their contents to be silently read into the AI's system…
- highCVE-2026-75913
CVE-2026-75913: CodeWhale Argument Injection in git_show Allows Arbitrary File Write
A missing input guard in CodeWhale's git_show tool lets an attacker inject a --output= flag into the git command, silently overwriting any file the user owns without ever showing an approval prompt.
- highCVE-2026-75858
CVE-2026-75858: CodeWhale rlm_eval Approval Bypass Leading to Unsandboxed RCE
A missing approval gate in CodeWhale's rlm_eval tool lets the AI model run arbitrary Python code on your machine without ever asking for permission, even if you have a strict approval policy…
- highCVE-2026-75857
CVE-2026-75857: CodeWhale exec_shell_interact Approval Bypass Privilege Escalation
CodeWhale's tool for sending input to a running interactive shell skips the approval prompt entirely, so an attacker who can inject instructions into the agent's context can run arbitrary commands…
- highCVE-2026-75915
CVE-2026-75915: CodeWhale deepseek-tui js_execution Environment Variable Leak
The js_execution tool in CodeWhale spawns Node.js without clearing the parent process environment, so any JavaScript the model runs can read and return every shell-exported secret, including API keys…
- criticalCVE-2026-75856
CVE-2026-75856: CodeWhale (deepseek-tui) SSRF via DNS Pinning TOCTOU Bypass
A flaw in CodeWhale's fetch_url tool lets an attacker control a DNS server to make the first resolution fail (bypassing the IP blocklist check) and the second succeed with an internal address…
- highCVE-2026-75914
CVE-2026-75914: CodeWhale image_analyze Symlink Path Traversal
The image_analyze tool in CodeWhale skips symlink canonicalization, so a workspace symlink pointing at any file outside the workspace silently leaks that file's bytes to the configured vision API…
- highCVE-2026-72804
CVE-2026-72804: SiYuan Graph Endpoints Missing Publish-Password Check
SiYuan's graph API endpoints leak the full block-level content of password-protected documents to any anonymous or low-privilege publish reader, because the graph filter checks document visibility…
- highCVE-2026-72801
CVE-2026-72801: SiYuan Encrypted Notebook Key Material Disclosed to Anonymous Readers
SiYuan's publish-mode API leaks the Argon2id salt, cost parameters, and AES-GCM password verifier to unauthenticated readers, letting an attacker crack the encrypted-notebook master password entirely…
- criticalCVE-2026-72811
CVE-2026-72811: SiYuan SQL Injection via Backlink and Mention Search
SiYuan's backlink and mention search concatenates stored document titles and client keywords into a SQL query without escaping single quotes, letting an anonymous reader inject arbitrary SQL into the…
- highCVE-2026-72810
CVE-2026-72810: SiYuan WebSocket Broadcast Publish-Boundary Bypass
SiYuan's publish-mode WebSocket connection shares the same broadcast pool as authenticated sessions, so an anonymous reader can silently receive every live edit made in the workspace, including…
- highCVE-2026-68587
CVE-2026-68587: SiYuan getHeading*Transaction Publish-Disabled Document Disclosure
Three SiYuan API endpoints meant for heading operations return the full rendered HTML of a document to anonymous readers, even when an administrator has explicitly disabled public access to that…