EUVD-2026-60964

CodeWhale versions = 0.8.41 and 0.8.64 contain a vulnerability in the execshellinteract alias execinteract tool, whose approvalrequirement returns ApprovalRequirement::Auto. This overrides the default Required approval for code-executing tools, so LLM-controlled stdin is written into an...

CVE-2026-75857 CodeWhale before 0.8.64 Privilege Escalation via exec_shell_interact

CodeWhale versions = 0.8.41 and 0.8.64 contain a vulnerability in the execshellinteract alias execinteract tool, whose approvalrequirement returns ApprovalRequirement::Auto. This overrides the default Required approval for code-executing tools, so LLM-controlled stdin is written into an...

CVE-2026-75857

CodeWhale versions 0.8.41–0.8.63 have exec_shell_interact returning ApprovalRequirement::Auto, bypassing approval prompts and writing LLM-controlled stdin into already-approved interactive shells (python3 -i, mysql, ssh, sudo -i). An attacker injecting instructions via untrusted ingested content ...