CVE-2026-75858: CodeWhale rlm_eval before 0.8.64 Remote Code Execution
CodeWhale (packages codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain a remote code execution vulnerability in the rlmeval tool. The tool's approvalrequirement() returns ApprovalRequirement::Auto, which the engine treats as 'never prompt,' causing arbitrary model-supplied Python code to run in a python3 interpreter without consulting the user's configured --approval-policy and without any approval prompt or audit step. An attacker can induce the agent to execute arbitrary code via prompt injection in untrusted content the agent reads (a web page, fetched URL, repository file, or MCP tool result); the companion rlmopen tool can stage such content. Code runs on the user's machine at the user's privilege level. Fixed in 0.8.64.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
codewhale/rlm_evalto a version that resolves this vulnerability.Fixed in 0.8.64 - Compensating control
Use codewhale packages version < 0.8.41 or >= 0.8.64 to avoid the rlm_eval remote code execution vulnerability present in versions >= 0.8.41 and < 0.8.64.
Event History
Frequently Asked Questions
Who is realistically exposed to exploitation?
Users of CodeWhale or codewhale-tui versions 0.8.41 through 0.8.63 are affected when the agent can read untrusted content, including web pages, fetched URLs, repository files, or MCP tool results. The resulting code executes locally with the privileges of the user running the agent.
What does an attacker need to exploit this?
An attacker does not need local privileges, but must cause the agent to process attacker-controlled content containing a prompt injection that induces use of rlm_eval. The rlm_open tool can be used to stage malicious content for the agent to read.
Are approval policies or user prompts effective protection?
Yes. rlm_eval reports automatic approval, which the engine interprets as never prompting, so configured --approval-policy settings are not consulted and no approval or audit step occurs before Python code runs.
What should be done if patching cannot happen immediately?
Update to version 0.8.64, which fixes the issue. If updating is not immediately possible, avoid allowing the agent to read untrusted web content, URLs, repository files, and MCP tool results that could contain prompt-injection instructions.