GHSA-WRJ3-VJ8C-784F CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE)

Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 57f3c89471e27ac4032d9791f6885e5d4408c381. Users should upgrade to 0.8.64 or later. The original reporter analysis is...

CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE)

Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 57f3c89471e27ac4032d9791f6885e5d4408c381. Users should upgrade to 0.8.64 or later. The original reporter analysis is...

NPM: CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE)

NPM: CodeWhale: rlmeval auto-approves arbitrary Python execution, bypassing the user's approval policy RCE vulnerability discovered by ? in WordPress Npm codewhale versions = 0.8.41, 0.8.64...

NPM: CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE)

NPM: CodeWhale: rlmeval auto-approves arbitrary Python execution, bypassing the user's approval policy RCE vulnerability discovered by ? in WordPress Npm deepseek-tui versions = 0.8.33, 0.8.41...

EUVD-2026-60965

CodeWhale: rlmeval auto-approves arbitrary Python execution, bypassing the user's approval policy RCE...

CVE-2026-75858

CodeWhale packages codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain a remote code execution vulnerability in the rlmeval tool. The tool's approvalrequirement returns ApprovalRequirement::Auto, which the engine treats as 'never prompt,' causing arbitrary model-supplied Python code to...

CVE-2026-75858 CodeWhale rlm_eval before 0.8.64 Remote Code Execution

CodeWhale packages codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain a remote code execution vulnerability in the rlmeval tool. The tool's approvalrequirement returns ApprovalRequirement::Auto, which the engine treats as 'never prompt,' causing arbitrary model-supplied Python code to...

CVE-2026-75858 CodeWhale rlm_eval before 0.8.64 Remote Code Execution

CodeWhale packages codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain a remote code execution vulnerability in the rlmeval tool. The tool's approvalrequirement returns ApprovalRequirement::Auto, which the engine treats as 'never prompt,' causing arbitrary model-supplied Python code to...

CVE-2026-75858

In CodeWhale (codewhale/codewhale-tui) versions 0.8.41–0.8.63, rlm_eval's approval_requirement() returns ApprovalRequirement::Auto, causing the engine to execute arbitrary model-supplied Python code without consulting the user's --approval-policy or prompting for approval. An attacker can trigger...

CVE-2026-75858 CodeWhale rlm_eval before 0.8.64 Remote Code Execution

CodeWhale packages codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain a remote code execution vulnerability in the rlmeval tool. The tool's approvalrequirement returns ApprovalRequirement::Auto, which the engine treats as 'never prompt,' causing arbitrary model-supplied Python code to...

CVE-2026-75858

CodeWhale packages codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain a remote code execution vulnerability in the rlmeval tool. The tool's approvalrequirement returns ApprovalRequirement::Auto, which the engine treats as 'never prompt,' causing arbitrary model-supplied Python code to...

CVE-2026-75858: Improper Control of Generation of Code

CodeWhale packages codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain a remote code execution vulnerability in the rlmeval tool. The tool's approvalrequirement returns ApprovalRequirement::Auto, which the engine treats as 'never prompt,' causing arbitrary model-supplied Python code to...