DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-75911: CVE-2026-75911: Remote Code Execution via Configuration Override in CodeWhale

#security #cve #cybersecurity

CVE-2026-75911: Remote Code Execution via Configuration Override in CodeWhale

Vulnerability ID: CVE-2026-75911
CVSS Score: 8.5
Published: 2026-09-04

CVE-2026-75911 is a configuration injection and remote code execution vulnerability in CodeWhale. Unsafe merging of repository-level TOML configuration files allows malicious repositories to silently enable shell tool registration and inject prompts, forcing the integrated LLM agent to execute arbitrary host commands.

TL;DR

Insecure workspace configuration merging in CodeWhale lets a malicious git repository silently enable shell access and execute arbitrary commands via prompt injection when the workspace is opened.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-94
  • Attack Vector: Local (User-initiated clone & open)
  • CVSS v4.0: 8.5 (High)
  • CVSS v3.1: 7.8 (High)
  • Exploit Status: Proof-of-Concept
  • CISA KEV Status: Not Listed

Affected Systems

  • CodeWhale Terminal User Interface (TUI) workspace environment
  • CodeWhale: >= 0.8.6, < 0.8.41 (Fixed in: 0.8.41)
  • CodeWhale: >= 0.8.41, < 0.8.64 (Fixed in: 0.8.64)

Code Analysis

Commit: 4356335

Enforce strict unidirectional workspace permissions and drop instructions overwrite

--- a/crates/tui/src/main.rs
+++ b/crates/tui/src/main.rs
Enter fullscreen mode Exit fullscreen mode

Exploit Details

  • GHSA-gx45-xrj5-g6c4: Security advisory containing the conceptual trigger details for project configuration override

Mitigation Strategies

  • Disable workspace configurations completely when running untrusted code
  • Restrict shell access in global configs
  • Isolate terminal developer tools in sandboxed containers (Docker, DevContainers)

Remediation Steps:

  1. Upgrade CodeWhale client to version 0.8.64 or later.
  2. Verify and sanitize existing .codewhale configurations in local directories.
  3. Explicitly configure 'allow_shell = false' globally to enforce a safe baseline.

References

Read the full report for CVE-2026-75911 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)