Hmbown CodeWhale bug lets AI run code without asking

Published September 4, 2026 CVE-2026-75858

CodeWhale is a terminal coding assistant that lets an AI model run Python code on your machine. A bug makes one of its tools run that code automatically, with no permission prompt, even when you have approval checks turned.

Severity
HighCVSS 3.1 · 7.8
Fix
Fixed in 0.8.41, 0.8.64Fix recorded on Sep 4, 2026
Affected versions
0.8.33 or newer and 0.8.41 or older; 0.8.33 or newer, but before 0.8.41; 0.8.41 or newer, but before 0.8.64+1 more
Weakness
CWE-94Code Injection
Exploit likelihood
0.27% in 30 daysEPSS, higher than 19% of known flaws
Affects
codewhale-tui

How it works

CodeWhale's rlm_eval tool is marked as never needing approval, so whenever the AI model decides to run a piece of Python code, it executes immediately instead of asking the developer, regardless of the approval setting the developer chose when starting CodeWhale.

What to do

Check your installed CodeWhale version with npm list -g codewhale (or check the version shown by the codewhale-tui binary) and compare it against 0.8.64. If it is 0.8.41 or higher and lower than 0.8.64, you are affected. Upgrade to codewhale or codewhale-tui version 0.8.64 or later, which contains the fix, and confirm the update took effect by checking the version again.

Run this in the application environment you want to check:

npm list -g codewhale

Technical details

Affected software: codewhale-tui

CodeWhale: rlmeval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE). Maintainer resolution The CodeWhale maintainers validated this report.

Severity breakdown

  • Attack vector Local Needs local access to the machine
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction Required Requires another user to take an action
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source