CVE-2026-75858 in CodeWhale
Summary
by MITRE • 08/18/2026
CodeWhale (packages codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain a remote code execution vulnerability in the rlm_eval tool. The tool's approval_requirement() returns ApprovalRequirement::Auto, which the engine treats as 'never prompt,' causing arbitrary model-supplied Python code to run in a python3 interpreter without consulting the user's configured --approval-policy and without any approval prompt or audit step. An attacker can induce the agent to execute arbitrary code via prompt injection in untrusted content the agent reads (a web page, fetched URL, repository file, or MCP tool result); the companion rlm_open tool can stage such content. Code runs on the user's machine at the user's privilege level. Fixed in 0.8.64.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified within CodeWhale versions ranging from 0.8.41 to just before 0.8.64 represents a critical remote code execution flaw located specifically within the rlm_eval tool component of both codewhale and codewhale-tui packages. This security defect stems from an improper handling of approval requirements, where the function approval_requirement() erroneously returns ApprovalRequirement::Auto. In the context of this software architecture, the engine interprets this Auto designation as a directive to never prompt the user for confirmation. Consequently, any Python code supplied by the model is executed directly within a python3 interpreter environment without adhering to the user's configured --approval-policy settings or triggering any necessary approval prompts or audit steps. This behavior fundamentally breaks the intended security boundary between automated agent actions and human oversight, allowing unverified computational tasks to proceed with full system privileges.
The operational impact of this vulnerability is severe due to its susceptibility to prompt injection attacks via untrusted content sources. An attacker can exploit this flaw by inducing the agent to process malicious payloads embedded in various data types that the agent is designed to read and analyze. These vectors include web pages, fetched URLs, repository files, or results returned from Model Context Protocol tools. The companion rlm_open tool further exacerbates the risk by providing a mechanism for an attacker to stage such untrusted content within the context of the agent's operation. Once the agent processes this injected content, it may interpret malicious instructions as legitimate commands, leading to the execution of arbitrary Python code on the user's local machine. This execution occurs at the privilege level of the currently logged-in user, potentially granting an attacker full control over the system environment, access to sensitive data, and the ability to install persistent backdoors or perform lateral movement within a networked environment.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) as it allows for the injection and execution of arbitrary code through user-controllable input that is misinterpreted by the application logic. Furthermore, the exploitation method involving prompt injection to manipulate an AI agent's behavior maps directly to MITRE ATT&CK technique T1620 Abuse Execution Mechanisms: Prompt Injection. The failure to enforce approval policies also relates to CWE-798 Use of Hard-coded Credentials or Configuration Values if interpreted as a misconfiguration leading to privilege escalation, but more accurately reflects CWE-20 Improper Input Validation where the system fails to validate that code execution requests require human intervention based on policy settings.
To mitigate this vulnerability and prevent similar issues in future iterations, it is imperative to enforce strict input validation and output encoding practices when handling data from untrusted sources such as web pages or external tool results. The approval_requirement() function must be corrected to respect the user's configured --approval-policy by ensuring that Auto does not bypass human-in-the-loop requirements for code execution tasks. Implementing a mandatory confirmation step for any dynamic code generation or execution, regardless of the source confidence score, is essential. Additionally, developers should adopt defense-in-depth strategies such as sandboxing Python interpreters to limit system access and implementing comprehensive audit logging for all code execution events to ensure visibility into agent activities. Updating to version 0.8.64 or later resolves this issue by correcting the logic that incorrectly suppresses approval prompts, thereby restoring the intended security controls and user oversight mechanisms.