codewhale (npm)

Advisories

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 0.8.64 or later clears every advisory below that has a fix.

Upgrade commands

npm

npm install codewhale@0.8.64

yarn

yarn add codewhale@0.8.64

pnpm

pnpm add codewhale@0.8.64

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
GHSA-h539-c7r8-3xq4 CodeWhale: js_execution leaks parent environment to model context via missing env scrub	High EPSS 0.68%	`>= 0.8.41, < 0.8.64`	`0.8.64`
GHSA-w7wx-5q49-r59w CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes	High EPSS 0.53%	`>= 0.8.41, < 0.8.64`	`0.8.64`
GHSA-7j5w-7r7x-9v27 CodeWhale: Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Approval	Critical EPSS 0.48%	`>= 0.8.41, < 0.8.64`	`0.8.64`
GHSA-c6mw-8xh8-gpq6 CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval	High EPSS 0.45%	`>= 0.8.41, < 0.8.64`	`0.8.64`
GHSA-gx45-xrj5-g6c4 CodeWhale: Project config `allow_shell` override enables arbitrary shell command execution via cloned repository	High EPSS 0.25%	`>= 0.8.41, < 0.8.64`	`0.8.64`
GHSA-62f5-cp2p-vq95 CodeWhale: Project config `instructions` override enables arbitrary file read into AI system prompt via cloned repository	High EPSS 0.53%	`>= 0.8.41, < 0.8.64`	`0.8.64`
GHSA-wrj3-vj8c-784f CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE)	High EPSS 0.36%	`>= 0.8.41, < 0.8.64`	`0.8.64`
GHSA-g29h-pfmp-qp9r CodeWhale: exec_shell_interact sends LLM-controlled input to a running shell without an approval prompt (privilege escalation)	High EPSS 0.15%	`>= 0.8.41, < 0.8.64`	`0.8.64`
GHSA-6v2g-fpxh-pmmh CodeWhale: SSRF‌ bypass - TOCTOU on DNS failure for DNS pinning	High EPSS 0.50%	`>= 0.8.41, < 0.8.64`	`0.8.64`

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor