Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| deepseek-tui | rust | >= 0.3.27, <= 0.8.41 | |
| deepseek-tui | npm | >= 0.3.27, < 0.8.41 | 0.8.41 |
| codewhale-tui | rust | >= 0.8.41, < 0.8.64 | 0.8.64 |
| codewhale | npm | >= 0.8.41, < 0.8.64 | 0.8.64 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-75912, is an argument injection flaw affecting the git_blame and git_show tools within the CodeWhale (formerly DeepSeek-TUI) application. The root cause is the insufficient validation of the rev parameter, which is supplied by the model and directly incorporated into git blame or git show commands. This allows an attacker to inject arbitrary command-line options, such as --contents=<file>, leading to arbitrary file disclosure. The provided patch (commit 9a34b5034d29f05d1f28fa61b04719ca6a741020) introduces a new validation function, validate_git_rev, and integrates it into both GitBlameTool::execute and GitShowTool::execute methods in crates/tui/src/tools/git_history.rs. Before this patch, these execute methods were directly responsible for constructing and executing the git commands with unvalidated user-controlled input, making them the vulnerable functions. When the vulnerability is triggered, either GitBlameTool::execute or GitShowTool::execute would appear in the runtime profile as they are the entry points for processing the malicious rev argument and initiating the vulnerable git command execution.
tui::tools::git_history::GitBlameTool::executecrates/tui/src/tools/git_history.rs
tui::tools::git_history::GitShowTool::executecrates/tui/src/tools/git_history.rs