HighVulnerabilityLLM-specific
GHSA-gx45-xrj5-g6c4: CodeWhale: Project config `allow_shell` override enables arbitrary shell command execution via cloned repository
- Identifiers
- CVE-2026-75911GHSA-gx45-xrj5-g6c4
- Published
- Record updated
- Affected
- codewhale >= 0.8.41, < 0.8.64, fixed in 0.8.64, released June 22, 2026, 73 days before disclosure
- codewhale-tui >= 0.8.41, < 0.8.64, fixed in 0.8.64, released June 22, 2026, 74 days before disclosure
- deepseek-tui >= 0.8.6, < 0.8.41, fixed in 0.8.41, released July 27, 2026, 38 days before disclosure
- and 1 more
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.2%
Summary
CodeWhale's project config merge copies `allow_shell` from a repository's `.codewhale/config.toml` or `.deepseek/config.toml` without the tightening guard applied to `approval_policy` and `sandbox_mode`. A malicious config committed to a repository can silently set `allow_shell = true` for anyone who clones and opens it, exposing the model's `exec_shell` tool and allowing arbitrary shell command execution on the victim's machine without explicit opt-in. The merge at `crates/tui/src/main.rs:5181-5182` (v0.8.50) is applied automatically unless the user passes `--no-project-config`.
Mitigation
Fixed in 0.8.64 (commit 43563356b98c6b993085554da82e77370160a31c). Users should upgrade to 0.8.64 or later.
Related items
- MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
- MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
- HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
- InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
- MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online