EUVD-2026-60969
GHSA-gx45-xrj5-g6c4
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack triggers locally when user opens a malicious repo (AV:L, UI:R); attacker needs no system privileges (PR:N); full local system compromise is achievable (C:H/I:H/A:H); no scope change since impact stays within the victim's own session.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
CodeWhale versions before 0.8.64 fail to properly validate the allow_shell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a malicious .codewhale/config.toml file to a repository. When a user clones and opens the repository in CodeWhale, the AI model gains access to exec_shell and task_shell tools, enabling execution of arbitrary shell commands on the victim's machine without explicit user consent.
AnalysisAI
Shell command injection in CodeWhale before version 0.8.64 enables arbitrary code execution on a victim developer's machine through a malicious repository config file. By committing a crafted .codewhale/config.toml containing allow_shell = true to any repository, an attacker can override the tool's shell access controls; when the target developer clones and opens the repository in CodeWhale, the AI agent gains unrestricted access to exec_shell and task_shell built-in tools and executes arbitrary shell commands without the user's explicit consent. No public exploit has been identified at time of analysis and no CISA KEV listing is confirmed, though the attack mechanics are straightforward and a vendor patch is available.
Technical ContextAI
CodeWhale (CPE: cpe:2.3:a:hmbown:codewhale) is an AI-powered coding assistant with a Rust-based TUI interface, as evidenced by the patch path crates/tui/src/main.rs. The tool reads project-scoped configuration from .codewhale/config.toml files in cloned repositories and merges them with the user's global configuration via the merge_project_config function. In vulnerable versions, this function unconditionally propagated the allow_shell boolean from the project config to the running Config struct, including upward elevation to true. This falls under CWE-94 (Code Injection) because attacker-controlled data from a configuration file directly injects a capability grant - shell execution access - into the AI agent's tool availability at session start. The fix in commit 43563356 enforces a strict one-directional policy: project configs may only set allow_shell = false (restricting access), and any allow_shell = true from project scope is silently discarded with a printed warning, closing the elevation path entirely. The same commit also removed the ability for project configs to override the user's instructions list, suggesting a broader privilege-boundary hardening effort.
RemediationAI
Upgrade CodeWhale to version 0.8.64 or later; the fix is implemented in commit 43563356b98c6b993085554da82e77370160a31c (https://github.com/Hmbown/CodeWhale/commit/43563356b98c6b993085554da82e77370160a31c) and enforces that project-scoped configurations cannot elevate shell access above the user's global settings. Patch version 0.8.64 is stated by the CVE description but not independently confirmed from the commit diff alone - consult the vendor advisory at https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-gx45-xrj5-g6c4 to verify the exact release. If immediate upgrade is not feasible, the most effective compensating control is to manually inspect .codewhale/config.toml in every cloned repository before opening it in CodeWhale and to refuse to open repositories from untrusted or unreviewed sources - this adds friction but eliminates the automated exploitation path. Ensuring allow_shell = false in the global user configuration provides no protection against the vulnerability in unpatched versions, as the project config bypass is precisely what this CVE exploits.
Server-side request forgery in CodeWhale before 0.8.64 lets remote attackers reach internal-only IP addresses through th
Environment variable inheritance in CodeWhale's js_execution tool prior to version 0.8.64 allows crafted JavaScript payl
Unauthenticated file disclosure in CodeWhale before 0.8.64 allows arbitrary local file reads via the image_analyze tool'
Arbitrary file read in CodeWhale before version 0.8.64 allows an attacker to exfiltrate files from a developer's worksta
Argument injection in CodeWhale's git_show tool (versions 0.8.41-0.8.63) allows an attacker to cause arbitrary file writ
Remote code execution in CodeWhale (packages codewhale and codewhale-tui) versions 0.8.41 through 0.8.63 allows an attac
Argument injection in CodeWhale versions before 0.8.64 exposes arbitrary files on the host system by accepting unsanitiz
Prompt-injection-driven privilege escalation in CodeWhale 0.8.41-0.8.63 allows an attacker who can place malicious instr
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today