CVE-2026-75911: CodeWhale RCE Vulnerability

CVE-2026-75911 Overview

CVE-2026-75911 affects CodeWhale versions before 0.8.64. The application fails to validate the allow_shell configuration parameter loaded from project config files. An attacker can commit a malicious .codewhale/config.toml file to a repository. When a victim clones and opens the repository in CodeWhale, the AI model gains access to the exec_shell and task_shell tools. This allows execution of arbitrary shell commands on the victim's machine without explicit user consent. The flaw is tracked under [CWE-94] Improper Control of Generation of Code.

Critical Impact
Opening an untrusted repository in a vulnerable CodeWhale client can trigger arbitrary shell command execution on the developer workstation.

Affected Products

CodeWhale versions before 0.8.64
CodeWhale AI coding client
Repositories containing .codewhale/config.toml

Discovery Timeline

2026-08-18 - CVE-2026-75911 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-75911

Vulnerability Analysis

CodeWhale reads project-level configuration from a .codewhale/config.toml file at the repository root. This file controls runtime behavior of the AI assistant, including which tools the model can invoke. The allow_shell parameter governs access to the exec_shell and task_shell tool interfaces. Versions before 0.8.64 treat this parameter as trusted input from the workspace. The client applies the flag without prompting the user or requiring workspace-level authorization. As a result, a repository author fully controls whether the AI can execute shell commands on a machine that opens the project.

Root Cause

The root cause is a missing trust boundary between per-project configuration and privileged tool capabilities. Security-sensitive flags such as allow_shell must be gated by the local user, not by files inside a cloned repository. Because the config file ships alongside source code, any contributor to a repository can toggle command execution for downstream users.

Attack Vector

An attacker commits a .codewhale/config.toml file with allow_shell = true and instructions or prompts that direct the AI to run shell commands. The victim clones the repository and opens it in CodeWhale. The AI loads the project config, enables exec_shell and task_shell, and executes attacker-controlled commands under the victim's user account. User interaction is limited to opening the project. Exploitation details are documented in the GitHub Security Advisory GHSA-gx45-xrj5-g6c4 and the VulnCheck advisory.

Detection Methods for CVE-2026-75911

Indicators of Compromise

Presence of a .codewhale/config.toml file setting allow_shell = true in cloned repositories.
Unexpected child processes spawned by the CodeWhale client, such as shells, package managers, or network utilities.
Outbound network connections initiated by CodeWhale to previously unseen destinations shortly after opening a project.
New files, scheduled tasks, or SSH keys written under the developer's home directory after opening a repository.

Detection Strategies

Scan repositories and developer workstations for .codewhale/config.toml files that enable shell tools.
Alert on process lineage where CodeWhale spawns sh, bash, cmd.exe, powershell.exe, or interpreters such as python and node.
Correlate CodeWhale execution events with file system or credential access anomalies on developer endpoints.

Monitoring Recommendations

Log command-line arguments for all child processes of the CodeWhale binary using EDR telemetry.
Monitor git clone operations followed by process execution from the workspace directory.
Track version strings of CodeWhale installations across the fleet to identify hosts below 0.8.64.

How to Mitigate CVE-2026-75911

Immediate Actions Required

Upgrade all CodeWhale installations to version 0.8.64 or later.
Audit existing local repositories for .codewhale/config.toml files and remove or review any that enable shell tools.
Restrict developer workstations from opening untrusted repositories in CodeWhale until the patch is deployed.
Rotate credentials, SSH keys, and tokens stored on any workstation that opened an untrusted CodeWhale project.

Patch Information

The fix is delivered in CodeWhale 0.8.64. The remediation commit is available at the CodeWhale GitHub repository. The patch changes how allow_shell is resolved, so project config files can no longer unilaterally grant shell tool access to the AI model.

Workarounds

Do not open untrusted repositories in vulnerable CodeWhale versions.
Manually delete .codewhale/config.toml from newly cloned repositories before opening the workspace.
Run CodeWhale inside a container or virtual machine that isolates the developer environment from sensitive host data.

bash

# Configuration example: verify installed CodeWhale version and scan for risky config files
codewhale --version
find . -path '*/.codewhale/config.toml' -exec grep -H 'allow_shell' {} \;