Executive brief
CodeWhale is an AI-assisted coding agent that manages shell execution with an approval system. The `exec_shell_interact` function bypasses this approval requirement when sending LLM-controlled input to an already-approved interactive shell (like a Python REPL, MySQL, or sudo session). An attacker can inject malicious commands through untrusted content that the agent consumes, and those commands execute with whatever privileges the shell holds—without prompting the user. This allows command execution as root or other privileged accounts if such a shell was previously opened.
Technical details
The vulnerability is a privilege management bypass in the `exec_shell_interact` tool (and its alias `exec_interact`). The function incorrectly returns `ApprovalRequirement::Auto`, which overrides the security-by-default `Required` setting that applies to tools marked with `ExecutesCode` capability. As a result, LLM-controlled stdin written to an interactive shell is never gated by the approval policy (`--approval-policy`), even though arbitrary code execution is occurring. The preconditions are: (1) shell tools must be enabled (standard configuration), and (2) the session must contain an approved long-running interactive process. After that, any prompt injection from fetched pages, MCP results, or repository files can steer the LLM to call `exec_shell_interact` with malicious input. The impact scales with the shell's privilege level—`sudo -i` grants root, `mysql -u root` enables arbitrary SQL, and `ssh host` executes commands on remote systems, all without re-prompting. The fix was merged in commit 57f3c89 and released in version 0.8.64.
Affected products
- Hmbown CodeWhale >= 0.8.41, < 0.8.64
- Hmbown codewhale-tui >= 0.8.41, < 0.8.64
- Hmbown deepseek-tui >= 0.3.10, <= 0.8.41
Timeline
- 2026-07-16: disclosed: GitHub Advisory published
- 2026-08-18: advisory: NVD published CVE-2026-75857
- 2026-09-04: patched: Fix released in version 0.8.64 (commit 57f3c89471e27ac4032d9791f6885e5d4408c381)