CVE-2026-75911 in CodeWhale
Zusammenfassung
von MITRE • 18.08.2026
CodeWhale versions before 0.8.64 fail to properly validate the allow_shell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a malicious .codewhale/config.toml file to a repository. When a user clones and opens the repository in CodeWhale, the AI model gains access to exec_shell and task_shell tools, enabling execution of arbitrary shell commands on the victim's machine without explicit user consent.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.