CVE-2026-75858: CodeWhale rlm_eval Tool RCE Vulnerability

CVE-2026-75858 Overview

CVE-2026-75858 is a remote code execution vulnerability in CodeWhale, an agentic coding assistant distributed as the codewhale and codewhale-tui packages. Versions >= 0.8.41 and < 0.8.64 ship an rlm_eval tool whose approval_requirement() returns ApprovalRequirement::Auto. The engine interprets this value as never prompt, so the tool executes arbitrary model-supplied Python code in a python3 interpreter without honoring the user's --approval-policy and without any approval or audit step. Attackers deliver payloads through prompt injection in untrusted content the agent reads, then trigger execution on the user's machine at the user's privilege level. The issue is fixed in version 0.8.64.

Critical Impact
Prompt injection from a web page, repository file, or MCP tool result can silently run attacker-controlled Python on the developer workstation with the user's full privileges.

Affected Products

CodeWhale codewhale package versions >= 0.8.41 and < 0.8.64
CodeWhale codewhale-tui package versions >= 0.8.41 and < 0.8.64
Environments where the CodeWhale agent processes untrusted content (web pages, fetched URLs, repository files, or MCP tool results)

Discovery Timeline

2026-08-18 - CVE-2026-75858 published to NVD
2026-08-18 - Last updated in NVD database
Fixed in 0.8.64 - CodeWhale releases patched release requiring approval for interactive execution tools

Technical Details for CVE-2026-75858

Vulnerability Analysis

CodeWhale exposes an rlm_eval tool that runs Python code produced by the underlying language model. Each tool declares an approval policy through the approval_requirement() method. In vulnerable releases, rlm_eval returns ApprovalRequirement::Auto, which the engine treats as a blanket allow. The engine skips both the user's configured --approval-policy and any interactive prompt before invoking python3.

The companion rlm_open tool can fetch and stage untrusted content into the agent's context. When that content contains prompt-injection instructions, the model is steered into emitting Python payloads to rlm_eval. Execution occurs on the developer's machine with the developer's privileges, giving the attacker read and write access to source code, credentials in the environment, SSH keys, and outbound network access. The flaw is classified as CWE-94: Improper Control of Generation of Code.

Root Cause

The root cause is a mismatch between the tool's declared capabilities and the engine's approval semantics. rlm_eval advertised ToolCapability::Network and ToolCapability::ExecutesCode but omitted ToolCapability::RequiresApproval, and its approval_requirement() returned ApprovalRequirement::Auto. A tool that executes code sourced from a probabilistic model was therefore treated as an autonomous, non-interactive operation.

Attack Vector

Exploitation is local in CVSS terms but network-reachable in practice. An attacker plants prompt-injection instructions inside content the agent will ingest, such as a README, an issue comment, a web page, a fetched URL, or an MCP tool result. When a developer asks CodeWhale to analyze or summarize that content, the model calls rlm_eval with attacker-controlled Python. User interaction is limited to invoking the agent against the poisoned source.

rust

// Security patch in crates/tui/src/tools/rlm.rs
    fn capabilities(&self) -> Vec<ToolCapability> {
-        vec![ToolCapability::Network, ToolCapability::ExecutesCode]
+        vec![
+            ToolCapability::Network,
+            ToolCapability::ExecutesCode,
+            ToolCapability::RequiresApproval,
+        ]
    }

    fn approval_requirement(&self) -> ApprovalRequirement {
-        ApprovalRequirement::Auto
+        ApprovalRequirement::Required
    }

Source: GitHub commit 57f3c89

The patch adds ToolCapability::RequiresApproval and switches the approval requirement from Auto to Required, forcing the engine to consult the user before executing model-supplied code. An equivalent change was applied to crates/tui/src/tools/shell.rs for the shell execution tool.

Detection Methods for CVE-2026-75858

Indicators of Compromise

Unexpected python3 child processes spawned by the codewhale or codewhale-tui binary on developer workstations.
Outbound network connections from python3 processes launched under the CodeWhale process tree to non-development destinations.
CodeWhale sessions where rlm_open retrieved external content followed immediately by rlm_eval invocations.
New or modified files under user home directories, SSH key stores, or shell profile scripts written by a python3 process parented to CodeWhale.

Detection Strategies

Inventory installed CodeWhale versions and flag any release >= 0.8.41 and < 0.8.64.
Correlate CodeWhale tool-invocation logs to identify sequences where untrusted content ingestion is followed by code execution tools.
Alert on process-lineage patterns where an editor or terminal launches CodeWhale, which in turn launches python3 or a shell interpreter without an approval prompt event.

Monitoring Recommendations

Ship endpoint process telemetry and outbound connection logs from developer workstations to a centralized analytics pipeline for retrospective hunting.
Track file writes to sensitive paths such as ~/.ssh/, ~/.aws/, and ~/.config/ originating from interpreters spawned by AI agent processes.
Monitor DNS and egress from developer subnets for beaconing patterns emerging shortly after CodeWhale sessions.

How to Mitigate CVE-2026-75858

Immediate Actions Required

Upgrade codewhale and codewhale-tui to version 0.8.64 or later on every developer workstation and build agent.
Rotate credentials, tokens, and SSH keys that were reachable from any workstation that ran a vulnerable version against untrusted content.
Restrict CodeWhale from processing untrusted URLs, repositories, or MCP tool results until the upgrade is confirmed.

Patch Information

The fix is delivered in CodeWhale 0.8.64. Review the GitHub Security Advisory GHSA-wrj3-vj8c-784f, the VulnCheck advisory, and the upstream patch commit 57f3c89. The commit changes approval_requirement() for rlm_eval and the shell tool from ApprovalRequirement::Auto to ApprovalRequirement::Required and adds ToolCapability::RequiresApproval.

Workarounds

Downgrade to a release prior to 0.8.41 if operational constraints prevent upgrading to 0.8.64.
Run CodeWhale inside a sandbox, container, or dedicated non-privileged user account with no access to production secrets.
Disable or block the rlm_eval and rlm_open tools in agent configuration until the patched version is deployed.

bash

# Verify the installed CodeWhale version and upgrade
codewhale --version
pip install --upgrade 'codewhale>=0.8.64' 'codewhale-tui>=0.8.64'
codewhale --version   # confirm 0.8.64 or later