Which versions of CodeWhale are affected by CVE-2026-75857?

CodeWhale interactive agent deployment versions 0.8.41-0.8.63 contain a vulnerability allowing attackers with data-input access to bypass approval controls and execute unauthorized commands on…. A patch is available.

Is there a public PoC exploit available for CVE-2026-75857?

Yes, a public proof-of-concept exploit is available for CVE-2026-75857. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-75857?

Within 24 hours, identify all systems running CodeWhale versions 0.8.41 through 0.8.63 and assess which are configured for interactive shell sessions. Although no public exploit has been identified at time of analysis, the vulnerability poses significant risk and requires urgent patching. Within 7 days, upgrade all affected installations to CodeWhale 0.8.64 or later, prioritizing systems processing external or untrusted content inputs. Within 30 days, validate the upgrade across your environment and confirm that approval controls are enforcing correctly for all shell execution requests.

CodeWhale CVE-2026-75857

Q: What is the CVSS score of CVE-2026-75857?

CVE-2026-75857 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-60964 HIGH

Improper Privilege Management (CWE-269)

2026-08-18 VulnCheck

GHSA-g29h-pfmp-qp9r

Privilege Escalation Codewhale Hmbown

7.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.3 HIGH

CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.0 HIGH

AV:L because CodeWhale runs on the victim's local machine; AC:H and UI:R because an already-approved interactive shell must be running; PR:N because the attacker only needs to control content the agent fetches.

3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 18, 2026 - 15:47 vuln.today

Analysis Generated

Aug 18, 2026 - 15:47 vuln.today

CVE Published

Aug 18, 2026 - 15:21 cve.org

HIGH 7.3

DescriptionCVE.org

CodeWhale versions >= 0.8.41 and < 0.8.64 contain a vulnerability in the exec_shell_interact (alias exec_interact) tool, whose approval_requirement returns ApprovalRequirement::Auto. This overrides the default Required approval for code-executing tools, so LLM-controlled stdin is written into an already-approved long-running interactive shell (e.g., a python3 -i REPL, mysql, ssh, or sudo -i session) without any approval prompt. An attacker who can inject instructions via untrusted content the agent ingests (a fetched page, MCP result, or repo file) can cause commands to run at the privilege level of that approved process. Fixed in 0.8.64.

AnalysisAI

Prompt-injection-driven privilege escalation in CodeWhale 0.8.41-0.8.63 allows an attacker who can place malicious instructions in content the agent ingests to execute arbitrary commands inside an already-approved long-running interactive shell session - such as python3 -i, mysql, ssh, or sudo -i - without triggering any user approval prompt. The root cause is that exec_shell_interact (and its RlmEvalTool counterpart) hardcoded ApprovalRequirement::Auto, overriding the default Required gate that governs code-executing tools. Fixed in version 0.8.64; no public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

CodeWhale is a TUI-based AI coding agent (vendor: hmbown, CPE cpe:2.3:a:hmbown:codewhale:*:*:*:*:*:*:*:*) that channels LLM output into local shell sessions. The affected surface is two tool implementations: ShellInteractTool in crates/tui/src/tools/shell.rs and RlmEvalTool in crates/tui/src/tools/rlm.rs. Both returned ApprovalRequirement::Auto from their approval_requirement() method, meaning the agent framework would silently write LLM-controlled stdin into an interactive process without presenting an approval dialog. CWE-269 (Improper Privilege Management) applies because the tools failed to enforce the privilege boundary between the LLM-controlled input stream and processes that may be running at elevated privilege levels. The commit 57f3c89471e27ac4032d9791f6885e5d4408c381 fixes both tools by switching to ApprovalRequirement::Required and adding ToolCapability::RequiresApproval, restoring the approval gate, and adds regression tests asserting the corrected behavior.

RemediationAI

Upgrade to CodeWhale version 0.8.64 or later, which applies the fix from commit 57f3c89471e27ac4032d9791f6885e5d4408c381 and is confirmed by the GitHub security advisory at https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-g29h-pfmp-qp9r. If immediate upgrade is not possible, two compensating controls reduce risk: first, avoid running CodeWhale agent tasks that fetch or process external untrusted content (web pages, third-party MCP server output, unknown repository files) while any interactive shell session is open - this severs the injection delivery path; second, refrain from launching privileged interactive shells (sudo -i, ssh, mysql with elevated credentials) during agent sessions, which limits the impact of any successful injection to the privilege level of the user's normal session. Both workarounds reduce but do not eliminate risk, as the approval gate bypass remains present in unpatched versions.