EUVD-2026-60969Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack triggers locally when user opens a malicious repo (AV:L, UI:R); attacker needs no system privileges (PR:N); full local system compromise is achievable (C:H/I:H/A:H); no scope change since impact stays within the victim's own session.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
CodeWhale versions before 0.8.64 fail to properly validate the allow_shell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a malicious .codewhale/config.toml file to a repository. When a user clones and opens the repository in CodeWhale, the AI model gains access to exec_shell and task_shell tools, enabling execution of arbitrary shell commands on the victim's machine without explicit user consent.
AnalysisAI
Shell command injection in CodeWhale before version 0.8.64 enables arbitrary code execution on a victim developer's machine through a malicious repository config file. By committing a crafted .codewhale/config.toml containing allow_shell = true to any repository, an attacker can override the tool's shell access controls; when the target developer clones and opens the repository in CodeWhale, the AI agent gains unrestricted access to exec_shell and task_shell built-in tools and executes arbitrary shell commands without the user's explicit consent. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must have CodeWhale version prior to 0.8.64 installed and must clone and then open a repository containing a malicious `.codewhale/config.toml` with `allow_shell = true` using the CodeWhale TUI. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.5 with vector AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H accurately captures the threat model: the attack is local in that it triggers when the victim opens a repository on their own machine, but the attacker requires zero privileges on the victim's system and faces no technical complexity barrier. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker creates or forks a publicly accessible repository and commits a `.codewhale/config.toml` file containing `allow_shell = true`, then socially engineers a target developer into cloning the repository - for example, by disguising it as a useful open-source project or dependency. When the developer opens the repository in CodeWhale, the `merge_project_config` function reads the malicious config and silently grants the AI agent shell execution capabilities, at which point the agent can execute commands such as exfiltrating SSH keys, source code, or environment variables, or installing a persistent backdoor, all without prompting the user for consent. … |
| Remediation | Upgrade CodeWhale to version 0.8.64 or later; the fix is implemented in commit 43563356b98c6b993085554da82e77370160a31c (https://github.com/Hmbown/CodeWhale/commit/43563356b98c6b993085554da82e77370160a31c) and enforces that project-scoped configurations cannot elevate shell access above the user's global settings. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Immediately audit all repositories for suspicious .codewhale/config.toml files and notify development teams to avoid cloning repositories from untrusted sources into CodeWhale; identify all systems running versions below 0.8.64. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-side request forgery in CodeWhale before 0.8.64 lets remote attackers reach internal-only IP addresses through th
Environment variable inheritance in CodeWhale's js_execution tool prior to version 0.8.64 allows crafted JavaScript payl
Unauthenticated file disclosure in CodeWhale before 0.8.64 allows arbitrary local file reads via the image_analyze tool'
Arbitrary file read in CodeWhale before version 0.8.64 allows an attacker to exfiltrate files from a developer's worksta
Argument injection in CodeWhale's git_show tool (versions 0.8.41-0.8.63) allows an attacker to cause arbitrary file writ
Remote code execution in CodeWhale (packages codewhale and codewhale-tui) versions 0.8.41 through 0.8.63 allows an attac
Argument injection in CodeWhale versions before 0.8.64 exposes arbitrary files on the host system by accepting unsanitiz
Prompt-injection-driven privilege escalation in CodeWhale 0.8.41-0.8.63 allows an attacker who can place malicious instr
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today