CVE-2026-75911: high-severity vulnerability in Hmbown CodeWhale
CodeWhale before 0.8.64 Remote Code Execution via allow_shell
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.5epss 0.2%
CodeWhale versions before 0.8.64 fail to properly validate the allow_shell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a malicious .codewhale/config.toml file to a repository. When a user clones and opens the repository in CodeWhale, the AI model gains access to exec_shell and task_shell tools, enabling execution of arbitrary shell commands on the victim's machine without explicit user consent.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Hmbown · CodeWhaleRelated CVEs — Hmbown CodeWhale
In the same product, most dangerous first.
CVE-2026-75915HIGHCodeWhale before 0.8.64 Environment Variable Leak via js_executionEPSS 0.7%CVE-2026-45311CRITICALCodeWhale: run_tests Tool Enables RCE via Malicious Repository Without ApprovalEPSS 0.6%CVE-2026-75914HIGHCodeWhale before 0.8.64 Path Traversal via image_analyze symlinkEPSS 0.5%CVE-2026-75859HIGHCodeWhale before 0.8.64 Arbitrary File Read via instructionsEPSS 0.5%CVE-2026-75856CRITICALCodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOUEPSS 0.5%CVE-2026-75913HIGHCodeWhale before 0.8.64 Argument Injection via git_showEPSS 0.5%