# CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval

CodeWhale's git_blame tool passed unvalidated model-supplied rev into git argv, so --contents=/path leaked arbitrary host files past the workspace boundary.

- Payout: Research
- Severity: high
- Program: CodeWhale
- Found by: 0xEr3n
- Disclosed: 2026-09-04
- CVE: CVE-2026-75912
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-c6mw-8xh8-gpq6
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-c6mw-8xh8-gpq6
- Tags: area:ai domain:ai domain:desktop impact:data-leak kind:research platform:ghsa sev:high tech:rust technique:source-review vuln:command-injection vuln:info-disclosure vuln:prompt-injection

**Target:** AI coding agent TUI tool (git_blame) invoking system git
**Root cause:** The rev parameter is concatenated into git blame argv without a --end-of-options sentinel or leading-hyphen rejection, so git parses it as an option; only path goes through workspace-bounded resolve_path.
**Steps:**
1. Note git_blame builds argv as `git blame --date=iso -L{start},{end} [--line-porcelain] <rev> -- <pathspec>` with rev unvalidated.
2. Supply input `{"path": "a.txt", "rev": "--contents=/home/a/.ssh/id_rsa"}`.
3. Tool assembles `git blame --date=iso -L1,200 --contents=/home/a/.ssh/id_rsa -- a.txt`.
4. git echoes each line of the target file in blame output prefixed with `00000000 (External file (--contents) ...)`, returning contents to the model.
5. Chain: malicious repo AGENTS.md prompt injection -> model calls git_blame with crafted rev -> Auto approval -> leak in tool result.
**How found:** Code review of git_history.rs: noticed path is bounded by context.resolve_path but rev is not, and the `--` separator only terminates pathspec parsing, not option parsing of rev; then identified git blame's --contents flag as a verbatim file-echo primitive.
**Exploitation:** Malicious repository content prompt-injects the model into calling git_blame with rev=--contents=<sensitive path>; ApprovalRequirement::Auto means no user prompt, and the file contents land in model context, which can then be forwarded via fetch_url or summarized.
**Escalation:** Sibling git_show injection shares root cause; leaked secrets in model context can be exfiltrated via fetch_url subject to network policy.
**Insight:** In agent tool wrappers, audit every argv element separately: a `--` before the pathspec does not protect earlier positional args, and git subcommands carry file-reading flags (--contents, --ignore-revs-file) that turn option injection into arbitrary file read.