CVE-2026-75857: CodeWhale RCE Vulnerability

CVE-2026-75857 Overview

CVE-2026-75857 is a privilege escalation vulnerability in CodeWhale, an AI coding agent, affecting versions >= 0.8.41 and < 0.8.64. The flaw resides in the exec_shell_interact tool (aliased as exec_interact), whose approval_requirement returns ApprovalRequirement::Auto instead of Required. This bypasses the default human approval gate for code-executing tools. The large language model (LLM) can write stdin directly into an already-approved long-running interactive shell such as python3 -i, mysql, ssh, or sudo -i. An attacker who injects instructions through untrusted content ingested by the agent can execute commands at the privilege level of that approved process. The issue is fixed in version 0.8.64 and is tracked as [CWE-269: Improper Privilege Management].

Critical Impact
Prompt injection via untrusted content executes arbitrary commands inside privileged interactive shells without user approval prompts.

Affected Products

CodeWhale >= 0.8.41 and < 0.8.64
Deployments using the exec_shell_interact (exec_interact) tool
Agent sessions with active interactive shells (python3 -i, mysql, ssh, sudo -i)

Discovery Timeline

2026-08-18 - CVE CVE-2026-75857 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-75857

Vulnerability Analysis

CodeWhale exposes tools to an LLM-driven agent through a capability and approval model. Tools that execute code should declare ToolCapability::ExecutesCode and return ApprovalRequirement::Required so a human confirms each action. The exec_shell_interact tool declared ExecutesCode but returned ApprovalRequirement::Auto, opting out of the default approval gate.

The tool sends stdin to a persistent interactive process the user previously approved. Because a REPL or shell keeps running, subsequent stdin writes reuse that approved context. The agent can therefore issue arbitrary commands to python3, mysql, ssh, or a sudo -i session without additional prompts. This is a classic prompt injection escalation path where untrusted context controls a privileged sink.

Root Cause

The root cause is an incorrect approval policy on a code-executing tool. approval_requirement() returned ApprovalRequirement::Auto, and the capability set omitted ToolCapability::RequiresApproval. The trust model assumed the parent interactive process was safe once approved, ignoring that stdin is a code-execution channel.

Attack Vector

An attacker plants instructions in untrusted content the agent ingests, such as a fetched web page, a Model Context Protocol (MCP) tool result, or a file in a repository. When the agent processes that content, the LLM invokes exec_shell_interact and pipes attacker-controlled commands into the active REPL or shell. Commands execute with the privileges of that process, including root when sudo -i is active.

rust

     }
 
     fn capabilities(&self) -> Vec<ToolCapability> {
-        vec![ToolCapability::ExecutesCode]
+        vec![
+            ToolCapability::ExecutesCode,
+            ToolCapability::RequiresApproval,
+        ]
     }
 
     fn approval_requirement(&self) -> ApprovalRequirement {
-        ApprovalRequirement::Auto
+        ApprovalRequirement::Required
     }
 
     async fn execute(
// Source: https://github.com/Hmbown/CodeWhale/commit/57f3c89471e27ac4032d9791f6885e5d4408c381

Detection Methods for CVE-2026-75857

Indicators of Compromise

Unexpected child commands spawned inside long-running python3 -i, mysql, ssh, or sudo -i sessions launched by the CodeWhale agent.
CodeWhale audit logs showing exec_shell_interact (or exec_interact) invocations without corresponding approval events.
Outbound network connections or file writes originating from interactive shell PIDs owned by the agent user.

Detection Strategies

Inventory CodeWhale installations and flag any version between 0.8.41 and 0.8.63 inclusive.
Correlate agent tool-call telemetry with process creation events to identify stdin-driven command execution inside interactive sessions.
Alert when the CodeWhale process tree contains privileged children under sudo, ssh, or database CLIs without an approval log entry.

Monitoring Recommendations

Enable verbose logging of every exec_shell_interact tool call, including the stdin payload and target PID.
Monitor ingestion sources feeding the agent (web fetch, MCP servers, repository files) for indicator strings that resemble prompt injection.
Ship agent logs to a central data lake for retention and cross-correlation with endpoint process telemetry.

How to Mitigate CVE-2026-75857

Immediate Actions Required

Upgrade CodeWhale to version 0.8.64 or later on all workstations and build systems running the agent.
Terminate any active CodeWhale interactive shells started under vulnerable versions before resuming work.
Review agent audit logs for exec_shell_interact calls issued while running an affected release.

Patch Information

The fix in commit 57f3c89 updates both crates/tui/src/tools/rlm.rs and crates/tui/src/tools/shell.rs to add ToolCapability::RequiresApproval and change approval_requirement() to return ApprovalRequirement::Required. See the GitHub Security Advisory GHSA-g29h-pfmp-qp9r, the upstream patch commit, and the VulnCheck advisory.

Workarounds

Avoid launching interactive shells (python3 -i, mysql, ssh, sudo -i) from within the CodeWhale agent until upgraded.
Restrict the agent user account so it cannot invoke sudo or reach production databases and hosts.
Disable or firewall untrusted ingestion sources such as arbitrary web fetches and third-party MCP servers.

bash

# Verify installed version and upgrade
codewhale --version
cargo install --locked codewhale --version 0.8.64

# Kill any residual interactive shells spawned by the agent
pkill -u "$(whoami)" -f 'python3 -i|sudo -i|mysql|ssh'