Executive brief
CodeWhale is an AI coding assistant that can execute shell commands on a developer's machine when explicitly enabled. A malicious or compromised repository can override the user's security setting by including a project configuration file that automatically enables shell execution. When a developer clones and opens such a repository in CodeWhale, the AI model gains unrestricted ability to run arbitrary commands without the developer's knowledge or consent.
Technical details
The vulnerability is a configuration injection flaw in CodeWhale's project config merge logic (`crates/tui/src/main.rs:5181-5182`). The code unconditionally copies the `allow_shell` boolean from `.codewhale/config.toml` into the session configuration without applying a tightening guard. Unlike `approval_policy` and `sandbox_mode` which enforce "relaxation-prevention" semantics (project config can only tighten restrictions), `allow_shell` lacks this validation. This allows an attacker to set `allow_shell = true` in a committed repository config, automatically enabling the AI model's shell execution tools (`exec_shell`, `task_shell_start`, `task_shell_wait`). The merge occurs automatically when entering a repository directory unless the user passes the rarely-known `--no-project-config` flag. With shell tools enabled, the AI model can execute arbitrary commands via `Command::new(program)` (lines 832, 991, 1152 in `shell.rs`), including many "safe" commands that bypass approval prompts (e.g., `ls`, `cat`, `git status`, `cargo build`). Attack preconditions: user must clone a malicious/compromised repository and run CodeWhale within it. Fix available in version 0.8.64 which applies proper tightening-only semantics to `allow_shell`.
Affected products
- CodeWhale CodeWhale (npm) >=0.8.41, <0.8.64
- CodeWhale codewhale-tui (Rust) >=0.8.41, <0.8.64
- CodeWhale deepseek-tui (Rust) >=0.8.6, <=0.8.41
- CodeWhale deepseek-tui (npm) >=0.8.6, <0.8.41
Timeline
- 2026-07-16: disclosed
- 2026-07-16: advisory
- 2026-07-16: patched: Version 0.8.64 contains fix in commit 43563356b98c6b993085554da82e77370160a31c
- 2026-09-04: kev added