CVE-2026-75859

### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 43563356b98c6b993085554da82e77370160a31c. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below. ### Summary A malicious `.codewhale/config.toml` or `.deepseek/config.toml` committed to a repository can set `instructions` to an array of arbitrary file paths (including paths outside the workspace like `~/.ssh/id_rsa` or `~/.aws/credentials`) that are read from disk and injected into the AI model's system prompt. There is no path validation, workspace boundary check, or tightening guard on the `instructions` field. This enables a malicious repository to exfiltrate the contents of sensitive files on the victim's machine through the AI conversation. ### Details The project config merge function at `crates/tui/src/main.rs:5190-5197` (v0.8.50) copies the `instructions` array from a project-level config file into the live session config without any path validation: ```rust if let Some(arr) = table.get("instructions").and_then(toml::Value::as_array) { let entries: Vec<String> = arr .iter() .filter_map(|v| v.as_str().map(str::to_string)) .filter(|s| !s.trim().is_empty()) .collect(); config.instructions = Some(entries); } ``` These paths are then resolved via `expand_path` at `crates/tui/src/config.rs:2361-2371`, which expands `~` to the user's home directory and resolves environment variables: ```rust pub fn instructions_paths(&self) -> Vec<PathBuf> { self.instructions.as_deref().unwrap_or(&[]) .iter() .map(String::as_str) .map(str::trim) .filter(|s| !s.is_empty()) .map(expand_path) .collect() } ``` The resolved paths are loaded at prompt-render time in `crates/tui/src/prompts.rs:216` with no workspace boundary check: ```rust InstructionSource::File(path) =>