EUVD-2026-60964Severity by source
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:L because CodeWhale runs on the victim's local machine; AC:H and UI:R because an already-approved interactive shell must be running; PR:N because the attacker only needs to control content the agent fetches.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
CodeWhale versions >= 0.8.41 and < 0.8.64 contain a vulnerability in the exec_shell_interact (alias exec_interact) tool, whose approval_requirement returns ApprovalRequirement::Auto. This overrides the default Required approval for code-executing tools, so LLM-controlled stdin is written into an already-approved long-running interactive shell (e.g., a python3 -i REPL, mysql, ssh, or sudo -i session) without any approval prompt. An attacker who can inject instructions via untrusted content the agent ingests (a fetched page, MCP result, or repo file) can cause commands to run at the privilege level of that approved process. Fixed in 0.8.64.
AnalysisAI
Prompt-injection-driven privilege escalation in CodeWhale 0.8.41-0.8.63 allows an attacker who can place malicious instructions in content the agent ingests to execute arbitrary commands inside an already-approved long-running interactive shell session - such as python3 -i, mysql, ssh, or sudo -i - without triggering any user approval prompt. The root cause is that exec_shell_interact (and its RlmEvalTool counterpart) hardcoded ApprovalRequirement::Auto, overriding the default Required gate that governs code-executing tools. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all three conditions to hold simultaneously: (1) CodeWhale version >= 0.8.41 and < 0.8.64 is installed; (2) the user has started and approved a long-running interactive shell via exec_shell_interact - specifically processes such as python3 -i, mysql, ssh, or sudo -i - that remains open during the agent task; and (3) the agent ingests attacker-controlled content (a fetched web page, MCP server result, or repository file containing prompt injection instructions). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:N/UI:P, score 7.3) accurately reflects this attack's dependency on local execution context and a specific pre-existing condition: the user must have already started and approved an interactive shell. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker embeds prompt injection instructions in a publicly accessible resource the CodeWhale agent is directed to fetch - a repository README, a documentation page, or a malicious MCP server response. The agent, treating the injected text as legitimate LLM instructions, invokes exec_shell_interact to write attacker-controlled commands into the stdin of a sudo -i session the user already approved and left running. … |
| Remediation | Upgrade to CodeWhale version 0.8.64 or later, which applies the fix from commit 57f3c89471e27ac4032d9791f6885e5d4408c381 and is confirmed by the GitHub security advisory at https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-g29h-pfmp-qp9r. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running CodeWhale versions 0.8.41 through 0.8.63 and assess which are configured for interactive shell sessions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-side request forgery in CodeWhale before 0.8.64 lets remote attackers reach internal-only IP addresses through th
Environment variable inheritance in CodeWhale's js_execution tool prior to version 0.8.64 allows crafted JavaScript payl
Unauthenticated file disclosure in CodeWhale before 0.8.64 allows arbitrary local file reads via the image_analyze tool'
Arbitrary file read in CodeWhale before version 0.8.64 allows an attacker to exfiltrate files from a developer's worksta
Argument injection in CodeWhale's git_show tool (versions 0.8.41-0.8.63) allows an attacker to cause arbitrary file writ
Shell command injection in CodeWhale before version 0.8.64 enables arbitrary code execution on a victim developer's mach
Remote code execution in CodeWhale (packages codewhale and codewhale-tui) versions 0.8.41 through 0.8.63 allows an attac
Argument injection in CodeWhale versions before 0.8.64 exposes arbitrary files on the host system by accepting unsanitiz
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today