{"action":"Upgrade codewhale to 0.8.64 or later.","affected":[{"fixed":"0.8.64","introduced":"0.8.41"}],"component":"codewhale","cve_ids":["CVE-2026-75915"],"ecosystem":"npm","epss":0.00678,"exploited":false,"fixed_versions":["0.8.64"],"ghsa_id":"GHSA-h539-c7r8-3xq4","id":"tcs_01M5KF0AHPH7PZ853WBZFS9QV5","modified_at":"2026-09-04T19:00:04.288552964Z","published_at":"2026-09-04T18:03:08Z","references":["https://osv.dev/vulnerability/GHSA-h539-c7r8-3xq4","https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-h539-c7r8-3xq4","https://nvd.nist.gov/vuln/detail/CVE-2026-75915","https://github.com/Hmbown/CodeWhale/commit/26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e","https://github.com/Hmbown/CodeWhale","https://www.vulncheck.com/advisories/codewhale-before-environment-variable-leak-via-js-execution"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-h539-c7r8-3xq4#npm/codewhale","url":"https://osv.dev/vulnerability/GHSA-h539-c7r8-3xq4"}],"summary":"CodeWhale: js_execution leaks parent environment to model context via missing env scrub"}