# CVE-2026-45374: Hmbown CodeWhale RCE via insecure sub-agent defaults

Source: https://junglewise.ai/threats/cve-2026-45374-hmbown-codewhale-rce-via-insecure-sub-agent-defaults  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-45374 · Severity: critical · CVSS 9.6 · Published 2026-05-28

DeepSeek TUI is a terminal-based interface for interacting with AI models. A vulnerability exists where the tool's sub-agents are granted unrestricted shell access by default when a user approves a seemingly benign task. If a developer opens a malicious project repository, an attacker can use hidden instructions to trick the AI into executing harmful commands on the user's computer without further approval, potentially leading to full system compromise.

Technologies: [deepseek-tui (crates.io)](https://junglewise.ai/threats/technologies/deepseek-tui), [Hmbown CodeWhale](https://junglewise.ai/threats/technologies/codewhale). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [Hmbown](https://junglewise.ai/threats/vendors/hmbown).

## Quick answers

**Is CVE-2026-45374 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45374 being exploited in the wild.

**How severe is CVE-2026-45374?** Critical severity, with a CVSS score of 9.6, published 28 May 2026.

**Which products and versions are affected?** deepseek-tui (crates.io) < 0.8.26, SEMVER:introduced=0,fixed=0.8.26; Hmbown CodeWhale < 0.8.26.

**Is there a fix for CVE-2026-45374?** Yes. deepseek-tui (crates.io): upgrade to 0.8.26 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45374 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-45374?** Check whether you run deepseek-tui (crates.io) or Hmbown CodeWhale at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- deepseek-tui (crates.io): upgrade to 0.8.26 or later

  ```sh
  cargo update -p deepseek-tui
  ```


## Technical details

The vulnerability stems from insecure defaults in the `task_create` tool within `deepseek-tui`. Specifically, `allow_shell` and `auto_approve` both default to `true` for spawned sub-agents. An attacker can craft a malicious repository containing prompt injection instructions (e.g., in an `AGENTS.md` file). When a user approves a high-level task creation, the sub-agent reads these instructions and executes arbitrary shell commands via the inherited permissions without triggering additional user approval prompts. This bypasses the intended security boundary of the approval system. The issue is fixed in version 0.8.26 by changing these defaults to `false`.

## Affected products

- Hmbown/CodeWhale deepseek-tui < 0.8.26

## Identifiers

- CVE-2026-45374
- GHSA-72w5-pf8h-xfp4

## Timeline

- 2026-05-10: disclosed
- 2026-05-14: advisory: GitHub Advisory published
- 2026-05-28: other: NVD published

## References

- [https://api.github.com/users/47Cid](https://api.github.com/users/47Cid)
- [https://github.com/47Cid](https://github.com/47Cid)
- [https://api.github.com/users/47Cid/gists%7B/gist_id%7D](https://api.github.com/users/47Cid/gists%7B/gist_id%7D)
- [https://api.github.com/users/47Cid/repos](https://api.github.com/users/47Cid/repos)
- [https://avatars.githubusercontent.com/u/62759468?v=4](https://avatars.githubusercontent.com/u/62759468?v=4)
- [https://api.github.com/users/47Cid/events%7B/privacy%7D](https://api.github.com/users/47Cid/events%7B/privacy%7D)

## Related threats

- [CodeWhale project config allow_shell override enables arbitrary shell execution](https://junglewise.ai/threats/cve-2026-75911-codewhale-project-config-allow-shell-override-enables-arbitrary)
- [CodeWhale rlm_eval approval bypass code execution](https://junglewise.ai/threats/cve-2026-75858-codewhale-rlm-eval-approval-bypass-code-execution)
- [CodeWhale git_blame argument injection allows arbitrary file read](https://junglewise.ai/threats/cve-2026-75912-codewhale-git-blame-argument-injection-allows-arbitrary-file-read)
- [CodeWhale SSRF bypass via TOCTOU in DNS pinning](https://junglewise.ai/threats/cve-2026-75856-codewhale-ssrf-bypass-via-toctou-in-dns-pinning)
- [CodeWhale js_execution environment variable disclosure](https://junglewise.ai/threats/cve-2026-75915-codewhale-js-execution-environment-variable-disclosure)