CVE-2026-75915

Publié : 18 août 2026

Modifié : 18 août 2026

Score CVSS

7.5

HIGH

Description détaillée

CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API keys, cloud credentials, and authentication tokens back to the model context.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Références et Patchs

https://github.com/Hmbown/CodeWhale/commit/26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-h539-c7r8-3xq4 https://www.vulncheck.com/advisories/codewhale-before-environment-variable-leak-via-js-execution https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-h539-c7r8-3xq4

Dernières Vulnérabilités

CVE-2026-75924

A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across all namespaces. Additionally, it can approve arbitrary Certificate Signing Requests (CSRs), which could lead to information disclosure and privilege escalation within the cluster.

VOIR DÉTAILS

CVE-2026-75897

Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload is not bounded - might allow remote attackers to cause a denial of service via a crafted HTTP request.

VOIR DÉTAILS

CVE-2026-73372

Joomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2 - An improper access check injects contact information for unaccessible contact items into schema.org snippets.

VOIR DÉTAILS