HighVulnerabilityLLM-specific
GHSA-g29h-pfmp-qp9r: CodeWhale: exec_shell_interact sends LLM-controlled input to a running shell without an approval prompt (privilege escalation)
- Identifiers
- CVE-2026-75857GHSA-g29h-pfmp-qp9r
- Published
- Record updated
- Affected
- codewhale >= 0.8.41, < 0.8.64, fixed in 0.8.64, released June 22, 2026, 73 days before disclosure
- codewhale-tui >= 0.8.41, < 0.8.64, fixed in 0.8.64, released June 22, 2026, 74 days before disclosure
- deepseek-tui >= 0.3.10, < 0.8.41, fixed in 0.8.41, released May 23, 2026, 104 days before disclosure
- and 1 more
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.2%
Summary
CodeWhale's exec_shell_interact tool is marked ApprovalRequirement::Auto, so model-supplied input written to an already-approved interactive shell (such as a python3 -i REPL, mysql, ssh or sudo -i) runs without an approval prompt. Any untrusted content the agent reads can steer that input, giving command execution at the privilege level of the approved process.
Mitigation
Fixed in 0.8.64 (commit 57f3c89471e27ac4032d9791f6885e5d4408c381). Users should upgrade to 0.8.64 or later.
Related items
- MediumCVE-2026-122235: Jan workspace guard bypass allows file writes outside workspace via symlinksSimilar attack · NVD/CVE Database
- InfoSecureGARD: Dynamic Ontology-Guided Governance for Secure Tool-Using LLM AgentsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
- InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
- InfoSecuring Web Agents with the Compile-Then-Execute ParadigmSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
- InfoWhen File Ingestion Misleads Language Models: Measuring and Mitigating Divergences in Office DocumentsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)