CyberRota Analysis
AI-GeneratedCodeWhale versions prior to 0.8.64 are susceptible to a path traversal vulnerability in the image_analyze tool, allowing attackers to exploit symlinks to access and leak sensitive file data without user consent. This could lead to unauthorized exposure of files through the vision endpoint. Organizations utilizing affected versions should prioritize patching to mitigate potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without user approval.