CVE-2026-75911: CodeWhale before 0.8.64 Remote Code Execution via allow_shell
CodeWhale versions before 0.8.64 fail to properly validate the allowshell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a malicious .codewhale/config.toml file to a repository. When a user clones and opens the repository in CodeWhale, the AI model gains access to execshell and taskshell tools, enabling execution of arbitrary shell commands on the victim's machine without explicit user consent.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CodeWhaleto a version that resolves this vulnerability.Fixed in 0.8.64 - Configuration
Ensure allow_shell from project config is not allowed to enable arbitrary shell command execution; only enable allow_shell when you explicitly trust the repository/project and its .codewhale/config.toml, and otherwise prevent/ignore the setting so exec_shell/task_shell cannot be activated.
CodeWhale project config (config.toml) allow_shell = properly validated / disabled unless explicitly required - Operational
After upgrading to 0.8.64, review repositories previously opened in affected CodeWhale versions for any malicious commits (e.g., .codewhale/config.toml) and assume shell-command execution may have occurred on victim machines; revoke/rotate any secrets that may have been exposed.
Event History
Frequently Asked Questions
Who is affected in practice?
Users of CodeWhale versions before 0.8.64 are exposed when they clone and open a repository containing a malicious .codewhale/config.toml file. Exploitation requires the user to open the attacker-controlled repository in CodeWhale.
What does an attacker need to exploit this issue?
The attacker needs to be able to commit a malicious project configuration file to a repository that a victim will clone and open. No explicit consent from the victim is required for the AI model to gain access to the shell-execution tools.
What should teams do if they cannot patch immediately?
Upgrade CodeWhale to version 0.8.64 or later. Until upgrading is possible, do not open untrusted repositories in affected CodeWhale versions, particularly repositories containing .codewhale/config.toml files.
How can I identify potentially malicious repositories?
Check repositories opened with affected versions for a .codewhale/config.toml file that sets or enables the allow_shell configuration parameter. Such a configuration can grant the AI model access to exec_shell and task_shell.