Codewhale
Monthly
Environment variable inheritance in CodeWhale's js_execution tool prior to version 0.8.64 allows crafted JavaScript payloads to read the full parent process environment via process.env, exposing API keys, cloud credentials, and authentication tokens to the model context. The affected codebase is a Rust TUI AI coding assistant whose Node.js child process spawning failed to sanitize the environment before execution. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available via GitHub advisory GHSA-h539-c7r8-3xq4.
Unauthenticated file disclosure in CodeWhale before 0.8.64 allows arbitrary local file reads via the image_analyze tool's failure to resolve symbolic links before enforcing workspace boundaries. An attacker who can place a crafted symlink (named with an image extension) inside a victim's workspace - for example via a malicious git repository - can cause CodeWhale's vision endpoint to read and transmit the symlink target's bytes without user approval. No CISA KEV listing or public exploit has been identified, but the CVSS 4.0 score of 8.7 and high confidentiality impact make this a meaningful risk for developers who open untrusted projects in CodeWhale.
Argument injection in CodeWhale's git_show tool (versions 0.8.41-0.8.63) allows an attacker to cause arbitrary file writes at the invoking user's privilege level via a malicious repository combined with prompt injection. The model-supplied rev parameter is passed directly to git show argv without an --end-of-options sentinel, meaning a value beginning with --output= is interpreted by git as a file-write flag rather than a revision. Because the git_show tool is registered as auto-approved and advertised as read-only, exploitation bypasses the user confirmation prompt entirely, enabling silent overwrite of sensitive files such as ~/.ssh/authorized_keys or ~/.bashrc. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 0.8.64.
Argument injection in CodeWhale versions before 0.8.64 exposes arbitrary files on the host system by accepting unsanitized option-shaped values in the git_blame and git_show tools' rev parameter. An unauthenticated remote attacker who can influence the rev value - for example via a prompt injection payload in a malicious repository - can supply flags such as --contents=/home/user/.ssh/id_rsa, causing git to read and return the targeted file as tool output visible to the AI model. Vendor-released patch: 0.8.64 is available; no public exploit identified at time of analysis.
Shell command injection in CodeWhale before version 0.8.64 enables arbitrary code execution on a victim developer's machine through a malicious repository config file. By committing a crafted `.codewhale/config.toml` containing `allow_shell = true` to any repository, an attacker can override the tool's shell access controls; when the target developer clones and opens the repository in CodeWhale, the AI agent gains unrestricted access to `exec_shell` and `task_shell` built-in tools and executes arbitrary shell commands without the user's explicit consent. No public exploit has been identified at time of analysis and no CISA KEV listing is confirmed, though the attack mechanics are straightforward and a vendor patch is available.
Arbitrary file read in CodeWhale before version 0.8.64 allows an attacker to exfiltrate files from a developer's workstation by embedding a malicious `.codewhale/config.toml` in a repository. The `instructions` array in project config accepted arbitrary filesystem paths without workspace boundary enforcement, causing the tool to silently read and inject targeted files into the AI system prompt. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack primitive is a well-understood path traversal and requires no technical sophistication beyond crafting a config file.
Remote code execution in CodeWhale (packages codewhale and codewhale-tui) versions 0.8.41 through 0.8.63 allows an attacker to execute arbitrary Python code on the victim's machine by exploiting a hardcoded approval bypass in the rlm_eval built-in tool. The tool's approval_requirement() method returned ApprovalRequirement::Auto, causing the engine to silently skip user approval prompts regardless of the operator's configured --approval-policy, enabling prompt injection attacks through any external content the agent reads. No public exploit has been identified at time of analysis, but the attack surface encompasses any CodeWhale agent workflow that fetches untrusted content such as web pages, repository files, or MCP tool results.
Prompt-injection-driven privilege escalation in CodeWhale 0.8.41-0.8.63 allows an attacker who can place malicious instructions in content the agent ingests to execute arbitrary commands inside an already-approved long-running interactive shell session - such as python3 -i, mysql, ssh, or sudo -i - without triggering any user approval prompt. The root cause is that exec_shell_interact (and its RlmEvalTool counterpart) hardcoded ApprovalRequirement::Auto, overriding the default Required gate that governs code-executing tools. Fixed in version 0.8.64; no public exploit or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in CodeWhale before 0.8.64 lets remote attackers reach internal-only IP addresses through the agent's fetch_url tool by exploiting a time-of-check-time-of-use gap in its DNS-pinning defense. Because the pre-fetch validator treated a failed DNS lookup as a pass-through ('let the HTTP request proceed and fail naturally'), an attacker who controls DNS responses can make the safety check see a non-resolving or benign answer while the real request resolves to an internal address, bypassing the SSRF allow/deny policy. No public exploit identified at time of analysis; a vendor patch and fix commit exist, and the issue was reported by VulnCheck.
Environment variable inheritance in CodeWhale's js_execution tool prior to version 0.8.64 allows crafted JavaScript payloads to read the full parent process environment via process.env, exposing API keys, cloud credentials, and authentication tokens to the model context. The affected codebase is a Rust TUI AI coding assistant whose Node.js child process spawning failed to sanitize the environment before execution. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available via GitHub advisory GHSA-h539-c7r8-3xq4.
Unauthenticated file disclosure in CodeWhale before 0.8.64 allows arbitrary local file reads via the image_analyze tool's failure to resolve symbolic links before enforcing workspace boundaries. An attacker who can place a crafted symlink (named with an image extension) inside a victim's workspace - for example via a malicious git repository - can cause CodeWhale's vision endpoint to read and transmit the symlink target's bytes without user approval. No CISA KEV listing or public exploit has been identified, but the CVSS 4.0 score of 8.7 and high confidentiality impact make this a meaningful risk for developers who open untrusted projects in CodeWhale.
Argument injection in CodeWhale's git_show tool (versions 0.8.41-0.8.63) allows an attacker to cause arbitrary file writes at the invoking user's privilege level via a malicious repository combined with prompt injection. The model-supplied rev parameter is passed directly to git show argv without an --end-of-options sentinel, meaning a value beginning with --output= is interpreted by git as a file-write flag rather than a revision. Because the git_show tool is registered as auto-approved and advertised as read-only, exploitation bypasses the user confirmation prompt entirely, enabling silent overwrite of sensitive files such as ~/.ssh/authorized_keys or ~/.bashrc. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 0.8.64.
Argument injection in CodeWhale versions before 0.8.64 exposes arbitrary files on the host system by accepting unsanitized option-shaped values in the git_blame and git_show tools' rev parameter. An unauthenticated remote attacker who can influence the rev value - for example via a prompt injection payload in a malicious repository - can supply flags such as --contents=/home/user/.ssh/id_rsa, causing git to read and return the targeted file as tool output visible to the AI model. Vendor-released patch: 0.8.64 is available; no public exploit identified at time of analysis.
Shell command injection in CodeWhale before version 0.8.64 enables arbitrary code execution on a victim developer's machine through a malicious repository config file. By committing a crafted `.codewhale/config.toml` containing `allow_shell = true` to any repository, an attacker can override the tool's shell access controls; when the target developer clones and opens the repository in CodeWhale, the AI agent gains unrestricted access to `exec_shell` and `task_shell` built-in tools and executes arbitrary shell commands without the user's explicit consent. No public exploit has been identified at time of analysis and no CISA KEV listing is confirmed, though the attack mechanics are straightforward and a vendor patch is available.
Arbitrary file read in CodeWhale before version 0.8.64 allows an attacker to exfiltrate files from a developer's workstation by embedding a malicious `.codewhale/config.toml` in a repository. The `instructions` array in project config accepted arbitrary filesystem paths without workspace boundary enforcement, causing the tool to silently read and inject targeted files into the AI system prompt. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack primitive is a well-understood path traversal and requires no technical sophistication beyond crafting a config file.
Remote code execution in CodeWhale (packages codewhale and codewhale-tui) versions 0.8.41 through 0.8.63 allows an attacker to execute arbitrary Python code on the victim's machine by exploiting a hardcoded approval bypass in the rlm_eval built-in tool. The tool's approval_requirement() method returned ApprovalRequirement::Auto, causing the engine to silently skip user approval prompts regardless of the operator's configured --approval-policy, enabling prompt injection attacks through any external content the agent reads. No public exploit has been identified at time of analysis, but the attack surface encompasses any CodeWhale agent workflow that fetches untrusted content such as web pages, repository files, or MCP tool results.
Prompt-injection-driven privilege escalation in CodeWhale 0.8.41-0.8.63 allows an attacker who can place malicious instructions in content the agent ingests to execute arbitrary commands inside an already-approved long-running interactive shell session - such as python3 -i, mysql, ssh, or sudo -i - without triggering any user approval prompt. The root cause is that exec_shell_interact (and its RlmEvalTool counterpart) hardcoded ApprovalRequirement::Auto, overriding the default Required gate that governs code-executing tools. Fixed in version 0.8.64; no public exploit or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in CodeWhale before 0.8.64 lets remote attackers reach internal-only IP addresses through the agent's fetch_url tool by exploiting a time-of-check-time-of-use gap in its DNS-pinning defense. Because the pre-fetch validator treated a failed DNS lookup as a pass-through ('let the HTTP request proceed and fail naturally'), an attacker who controls DNS responses can make the safety check see a non-resolving or benign answer while the real request resolves to an internal address, bypassing the SSRF allow/deny policy. No public exploit identified at time of analysis; a vendor patch and fix commit exist, and the issue was reported by VulnCheck.