CVE-2026-75857: CodeWhale exec_shell_interact privilege escalation via LLM input

CVE-2026-75857 · Severity: high · CVSS 7 · Published 2026-08-18

CodeWhale is an AI-assisted coding agent that manages shell execution with an approval system. The `exec_shell_interact` function bypasses this approval requirement when sending LLM-controlled input to an already-approved interactive shell (like a Python REPL, MySQL, or sudo session). An attacker can inject malicious commands through untrusted content that the agent consumes, and those commands execute with whatever privileges the shell holds—without prompting the user. This allows command execution as root or other privileged accounts if such a shell was previously opened.

Technologies: codewhale-tui (crates.io), deepseek-tui (crates.io), Hmbown CodeWhale. Vendors: crates.io, Hmbown.

Quick answers

Is CVE-2026-75857 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-75857 being exploited in the wild.
How severe is CVE-2026-75857?
High severity, with a CVSS score of 7, published 18 August 2026.
Which products and versions are affected?
codewhale-tui (crates.io) >= 0.8.41, < 0.8.64; deepseek-tui (crates.io) >= 0.3.10, <= 0.8.41; Hmbown CodeWhale >= 0.8.41, < 0.8.64.
Is there a fix for CVE-2026-75857?
A patch was published on 2026-09-04: Fix released in version 0.8.64 (commit 57f3c89471e27ac4032d9791f6885e5d4408c381) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-75857 attacked?
It is attacked with local access.
Am I affected by CVE-2026-75857?
Check whether you run codewhale-tui (crates.io), deepseek-tui (crates.io) or Hmbown CodeWhale at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a privilege management bypass in the `exec_shell_interact` tool (and its alias `exec_interact`). The function incorrectly returns `ApprovalRequirement::Auto`, which overrides the security-by-default `Required` setting that applies to tools marked with `ExecutesCode` capability. As a result, LLM-controlled stdin written to an interactive shell is never gated by the approval policy (`--approval-policy`), even though arbitrary code execution is occurring. The preconditions are: (1) shell tools must be enabled (standard configuration), and (2) the session must contain an approved long-running interactive process. After that, any prompt injection from fetched pages, MCP results, or repository files can steer the LLM to call `exec_shell_interact` with malicious input. The impact scales with the shell's privilege level—`sudo -i` grants root, `mysql -u root` enables arbitrary SQL, and `ssh host` executes commands on remote systems, all without re-prompting. The fix was merged in commit 57f3c89 and released in version 0.8.64.

Affected products

  • Hmbown CodeWhale >= 0.8.41, < 0.8.64
  • Hmbown codewhale-tui >= 0.8.41, < 0.8.64
  • Hmbown deepseek-tui >= 0.3.10, <= 0.8.41

Identifiers

  • CVE-2026-75857
  • GHSA-g29h-pfmp-qp9r

Timeline

  • 2026-07-16: disclosed: GitHub Advisory published
  • 2026-08-18: advisory: NVD published CVE-2026-75857
  • 2026-09-04: patched: Fix released in version 0.8.64 (commit 57f3c89471e27ac4032d9791f6885e5d4408c381)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.