CVE-2026-75857: CodeWhale before 0.8.64 Privilege Escalation via exec_shell_interact
CodeWhale versions >= 0.8.41 and < 0.8.64 contain a vulnerability in the execshellinteract (alias execinteract) tool, whose approvalrequirement returns ApprovalRequirement::Auto. This overrides the default Required approval for code-executing tools, so LLM-controlled stdin is written into an already-approved long-running interactive shell (e.g., a python3 -i REPL, mysql, ssh, or sudo -i session) without any approval prompt. An attacker who can inject instructions via untrusted content the agent ingests (a fetched page, MCP result, or repo file) can cause commands to run at the privilege level of that approved process. Fixed in 0.8.64.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CodeWhaleto a version that resolves this vulnerability.Fixed in 0.8.64 - Configuration
Upgrade to CodeWhale 0.8.64 where exec_shell_interact/exec_interact is fixed; in affected versions (>= 0.8.41 and < 0.8.64) this tool uses ApprovalRequirement::Auto which allows LLM-controlled stdin to be written into an already-approved long-running interactive shell without an approval prompt.
CodeWhale exec_shell_interact (alias exec_interact) tool approval_requirement = ApprovalRequirement::Auto
Event History
Frequently Asked Questions
Which deployments are exposed?
Systems running CodeWhale 0.8.41 through 0.8.63 are affected when an agent has an already-approved long-running interactive shell session. The impact is at the privilege level of that process, including examples such as python3 -i, mysql, ssh, or sudo -i sessions.
What does an attacker need to exploit this issue?
An attacker needs to inject instructions through content the agent ingests, such as a fetched page, an MCP result, or a repository file. Exploitation also depends on the agent writing attacker-influenced input to an already-approved interactive shell session.
Does this bypass the normal approval control?
The affected tool changes the approval behavior from the default Required setting for code-executing tools to automatic approval. As a result, commands sent through exec_shell_interact or exec_interact do not trigger an approval prompt when written to an approved interactive shell.
What should be done if patching cannot happen immediately?
Upgrade CodeWhale to version 0.8.64. Until upgrading, avoid using exec_shell_interact or exec_interact with long-running interactive shells, particularly sessions operating with elevated privileges, and do not ingest untrusted pages, MCP results, or repository files into agents that can access those sessions.