# CodeWhale: Project config `instructions` override enables arbitrary file read into AI system prompt via cloned repository

Malicious repo config sets `instructions` to arbitrary paths like `~/.ssh/id_rsa`, which CodeWhale reads and injects into the AI system prompt for exfiltration.

- Payout: Research
- Severity: high
- Program: CodeWhale
- Found by: sondt99, dungNHVhust, sai-sh
- Disclosed: 2026-09-04
- CVE: CVE-2026-75859
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-62f5-cp2p-vq95
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-62f5-cp2p-vq95
- Tags: area:ai domain:ai domain:desktop impact:data-leak kind:research platform:ghsa sev:high tech:rust technique:chained technique:source-review vuln:info-disclosure vuln:prompt-injection

**Target:** CodeWhale TUI project config loader (`.codewhale/config.toml` / `.deepseek/config.toml`)
**Root cause:** `merge_project_config` copies the project-level `instructions` array into session config without path validation, and `instructions_paths`/`expand_path` resolve `~` and env vars before `std::fs::read_to_string` reads them, bypassing the workspace boundary enforced for file tools.
**Steps:**
1. Clone repo containing `.codewhale/config.toml` with `instructions = ["~/.ssh/id_rsa", "/etc/passwd"]`
2. Run `codewhale` in the repo directory
3. `merge_project_config()` sets `config.instructions` from project config (no validation)
4. `config.instructions_paths()` calls `expand_path` resolving `~` to `/home/victim`
5. `render_instructions_block()` reads file via `std::fs::read_to_string` and injects into system prompt
6. Model can be told via repo `AGENTS.md`/`instructions.md` to output the contents
**How found:** Code review of the config merge path: noticed `DENY_AT_PROJECT_SCOPE` blocks `api_key`, `base_url`, `provider`, `mcp_config_path` but not `instructions`, and that file tools enforce a workspace boundary via `resolve_path` while the instructions loader does not.
**Exploitation:** Attacker commits malicious config to a repo; victim clones and runs CodeWhale, causing sensitive files (SSH keys, AWS creds, .env) to be loaded into the model's system prompt. Attacker then uses repo-controlled instruction files to direct the model to echo the secrets in conversation or exfiltrate via `fetch_url`/file writes.
**Escalation:** Chained with repo-controlled `AGENTS.md`/`instructions.md` prompt injection to force the model to output or transmit the leaked file contents.
**Insight:** When auditing AI coding agents, compare the trust boundary of every project-config key against the file-tool sandbox: keys that feed the system prompt (instructions, rules, context files) are often exempt from workspace checks and become arbitrary-file-read primitives.