EUVD-2026-60965
GHSA-wrj3-vj8c-784f
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Execution is local to the user's machine (AV:L); no attacker privileges required (PR:N); user must run the agent against malicious content (UI:R); full CIA impact from arbitrary code execution.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
CodeWhale (packages codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain a remote code execution vulnerability in the rlm_eval tool. The tool's approval_requirement() returns ApprovalRequirement::Auto, which the engine treats as 'never prompt,' causing arbitrary model-supplied Python code to run in a python3 interpreter without consulting the user's configured --approval-policy and without any approval prompt or audit step. An attacker can induce the agent to execute arbitrary code via prompt injection in untrusted content the agent reads (a web page, fetched URL, repository file, or MCP tool result); the companion rlm_open tool can stage such content. Code runs on the user's machine at the user's privilege level. Fixed in 0.8.64.
Articles & Coverage 1
AnalysisAI
Remote code execution in CodeWhale (packages codewhale and codewhale-tui) versions 0.8.41 through 0.8.63 allows an attacker to execute arbitrary Python code on the victim's machine by exploiting a hardcoded approval bypass in the rlm_eval built-in tool. The tool's approval_requirement() method returned ApprovalRequirement::Auto, causing the engine to silently skip user approval prompts regardless of the operator's configured --approval-policy, enabling prompt injection attacks through any external content the agent reads. No public exploit has been identified at time of analysis, but the attack surface encompasses any CodeWhale agent workflow that fetches untrusted content such as web pages, repository files, or MCP tool results.
Technical ContextAI
CodeWhale is a Rust-based AI coding agent distributed under vendor hmbown as two packages - codewhale and codewhale-tui - confirmed by CPE strings cpe:2.3:a:hmbown:codewhale. The vulnerable component is RlmEvalTool, implemented in crates/tui/src/tools/rlm.rs, which executes model-supplied code via the local python3 interpreter. The root cause is CWE-94 (Improper Control of Code Generation / Code Injection): the approval_requirement() method was hardcoded to return ApprovalRequirement::Auto, a value the engine interprets as 'never prompt.' This caused the tool to bypass the user's --approval-policy enforcement entirely - no prompt, no audit log, no policy check. The companion rlm_open tool can be used to stage attacker-controlled content into the agent's context. The fix in commit 57f3c89471e27ac4032d9791f6885e5d4408c381 changes the return value to ApprovalRequirement::Required and adds ToolCapability::RequiresApproval to the tool's declared capability set. The same misconfiguration was simultaneously fixed in ShellInteractTool (crates/tui/src/tools/shell.rs), suggesting a systemic pattern of missing approval declarations across code-execution tools.
RemediationAI
Upgrade to CodeWhale version 0.8.64, which resolves the vulnerability by changing RlmEvalTool::approval_requirement() to return ApprovalRequirement::Required and declaring ToolCapability::RequiresApproval, ensuring all code execution through rlm_eval is gated on user confirmation consistent with the configured --approval-policy. The patch commit is available at https://github.com/Hmbown/CodeWhale/commit/57f3c89471e27ac4032d9791f6885e5d4408c381 and the vendor advisory at https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-wrj3-vj8c-784f. For environments where immediate upgrade is not possible, the most effective compensating control is to restrict CodeWhale agent workflows to fully trusted, pre-vetted local content - avoiding any use of rlm_open or URL-fetching capabilities against third-party or user-submitted content. Disabling the rlm_eval and rlm_open tools in the agent configuration entirely eliminates the attack surface but removes Python evaluation capability from all workflows. There is no known configuration flag to enforce approval on a per-tool basis in vulnerable versions, so content restriction is the only viable workaround.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today