CodeWhale repo config can silently enable shell access

Published September 4, 2026 CVE-2026-75911

CodeWhale is an AI coding assistant that can run commands in your project folder. A hidden setting in a cloned repository's config file can secretly switch on full shell access, letting the AI run commands on your computer without asking.

Severity
HighCVSS 3.1 · 7.8
Fix
Fixed in 0.8.41, 0.8.64Fix recorded on Sep 4, 2026
Affected versions
0.8.6 or newer and 0.8.41 or older; 0.8.6 or newer, but before 0.8.41; 0.8.41 or newer, but before 0.8.64+1 more
Weakness
CWE-94Code Injection
Exploit likelihood
0.25% in 30 daysEPSS, higher than 17% of known flaws
Affects
codewhale-tui+1 more

How it works

  • CodeWhale reads a project config file, .codewhale/config.toml or .deepseek/config.toml, automatically when you open a folder.
  • That file can include an allow_shell = true setting.
  • Other settings that loosen security get blocked from tightening further when set this way, but allow_shell has no such check.
  • So anyone who commits that line into a repository can flip on shell access for the next person who opens it in CodeWhale.
  • Once enabled, the AI model gains tools to run shell commands on that person's machine, with no prompt asking for permission.

What to do

Check your installed CodeWhale version: npm users can run npm ls codewhale, Rust users can check the codewhale-tui crate version. If it falls between 0.8.41 and 0.8.64 (not including 0.8.64), or you use deepseek-tui between 0.8.6 and 0.8.41, you are exposed. Also check any cloned repository for a .codewhale/config.toml or .deepseek/config.toml file containing allow_shell = true, since that is what triggers the silent shell access.

Run this in the application environment you want to check:

npm ls codewhale

Update to CodeWhale 0.8.64 or later, which blocks project config files from turning on allow_shell. The deepseek-tui npm package was fixed at 0.8.41, though the advisory lists no fixed version for the deepseek-tui Rust crate. Until you update, review any .codewhale/config.toml or .deepseek/config.toml in a cloned repository before opening it. See the GitHub advisory for full detail.

Technical details

Affected software: codewhale-tui, deepseek-tui

The flaw lets a project-level config file set allow_shell = true, which is then merged into the live session without the same tightening-only restriction applied to other security settings like approval policy and sandbox mode. With allow_shell, the AI model gains access to shell-execution tools and can run commands the model supplies. Fixed in codewhale/codewhale-tui 0.8.64; the deepseek-tui npm line was fixed at 0.8.41.

Severity breakdown

  • Attack vector Local Needs local access to the machine
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction Required Requires another user to take an action
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source