Executive brief
CodeWhale's JavaScript execution tool fails to sanitize environment variables before spawning Node.js, allowing the model to read and exfiltrate sensitive credentials (API keys, cloud secrets, tokens) that are exported in the user's shell. In automatic-approval mode, adversarial prompts can leak these credentials without user interaction.
Technical details
The js_execution tool spawns a Node.js subprocess using tokio::process::Command::new without invoking the project's child_env scrubber (apply_to_tokio_command), which is correctly applied by exec_shell, the Python REPL, and the MCP launcher. The subprocess inherits the complete parent process environment, and the tool's stdout (which includes output from model-provided JavaScript reading process.env) flows directly back into the model's context and transcript. An attacker can craft a prompt injection (via a fetched README, web page, or MCP server output) that causes the model to invoke js_execution with code that exfiltrates all environment variables. In YOLO mode (auto_approve=true), this happens without any user approval. The fix is a one-line addition: calling apply_to_tokio_command with an empty argument list to enable environment variable filtering, which drops credentials and retains only whitelisted benign variables (PATH, HOME, LANG, TMPDIR, proxy settings).
Affected products
- CodeWhale codewhale >=0.8.41, <0.8.64
- CodeWhale codewhale-tui >=0.8.41, <0.8.64
- CodeWhale deepseek-tui >=0.8.32, <=0.8.41
Timeline
- 2026-09-04: disclosed: Advisory published
- 2026-09-04: patched: Fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e; users should upgrade to 0.8.64 or later