# CodeWhale: Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Approval

CodeWhale's auto-approved git_show tool passes unvalidated rev into git argv, letting --output= overwrite arbitrary user files via prompt injection.

- Payout: Research
- Severity: high
- Program: CodeWhale
- Found by: 0xEr3n
- Disclosed: 2026-09-04
- CVE: CVE-2026-75913
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-7j5w-7r7x-9v27
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-7j5w-7r7x-9v27
- Tags: area:ai domain:ai domain:oss impact:integrity impact:rce kind:research platform:ghsa sev:high tech:llm tech:rust technique:source-review vuln:command-injection

**Target:** git_show tool in DeepSeek-TUI/CodeWhale agent CLI
**Root cause:** The model-supplied `rev` parameter is appended to the `git show` argv without an `--end-of-options` sentinel or leading-dash validation, so git parses it as an option such as `--output=<path>`. The tool is registered Auto-approval and ReadOnly, so the write occurs with no user prompt.
**Steps:**
1. Attacker repo's `AGENTS.md` instructs the model to call `git_show` with `rev` = `--output=/home/victim/.bashrc`
2. Victim opens repo in DeepSeek-TUI and triggers the agent loop
3. Tool assembles `git show --no-color --no-ext-diff --no-patch --stat --output=/home/victim/.bashrc`
4. No approval prompt (ApprovalRequirement::Auto); git truncates and writes attacker-controlled commit metadata/diff to target path
5. Repro against plain git: `git show --no-color --no-patch "--output=/home/lowtest/.bashrc_clobbered" HEAD` creates the file
**How found:** Code review of git_history.rs: noticed `rev` pushed into argv with no `--end-of-options` and no pattern in the JSON schema, then recognized git show shares the log/diff option parser exposing `--output`.
**Exploitation:** Malicious repository plus prompt injection via auto-loaded AGENTS.md (per CVE-2026-45311) causes the model to emit a crafted `--output=` rev; git opens the path O_WRONLY|O_CREAT|O_TRUNC and writes the HEAD commit rendering (subject, body, author, diff) as the invoking user, clobbering dotfiles, authorized_keys, or project source.
**Escalation:** Chainable to RCE by overwriting `~/.gitconfig` to set `core.editor`; also DoS/lockout by clobbering `~/.ssh/authorized_keys`.
**Insight:** When an agent tool shells out to git, check whether user/model-controlled refs are separated by `--end-of-options`; git's shared option parser accepts `--output=` on read-only-looking subcommands like show/log/diff, turning a 'read' tool into a file write.

## Proof of concept (copied exactly from the original report)

**git show --output clobber reproduction**

```
$ id
uid=1001(lowtest) gid=1001(lowtest) groups=1001(lowtest)

$ cd /tmp/lp && git init -q
$ echo a > a.txt && git add a.txt
$ git -c user.email=a@b -c user.name=a commit -q -m "lol"

$ git show --no-color --no-patch "--output=/home/lowtest/.bashrc_clobbered" HEAD
$ ls -la /home/lowtest/.bashrc_clobbered
-rw-rw-r-- 1 lowtest lowtest 128 May 19 07:05 /home/lowtest/.bashrc_clobbered
```

**Vulnerable argv with injected --output rev**

```
git show --no-color --no-ext-diff --no-patch --stat --output=/home/victim/.bashrc
```