High severity7.8NVD Advisory· Published Aug 18, 2026· Updated Sep 8, 2026
CVE-2026-75911
CVE-2026-75911
Description
CodeWhale versions before 0.8.64 fail to properly validate the allow_shell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a malicious .codewhale/config.toml file to a repository. When a user clones and opens the repository in CodeWhale, the AI model gains access to exec_shell and task_shell tools, enabling execution of arbitrary shell commands on the victim's machine without explicit user consent.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
deepseek-tuicrates.io | >= 0.8.6, <= 0.8.41 | — |
deepseek-tuinpm | >= 0.8.6, < 0.8.41 | 0.8.41 |
codewhale-tuicrates.io | >= 0.8.41, < 0.8.64 | 0.8.64 |
codewhalenpm | >= 0.8.41, < 0.8.64 | 0.8.64 |
Affected products
2Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-gx45-xrj5-g6c4ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-75911ghsaADVISORY
- github.com/Hmbown/CodeWhale/commit/43563356b98c6b993085554da82e77370160a31cnvdWEB
- github.com/Hmbown/CodeWhale/security/advisories/GHSA-gx45-xrj5-g6c4nvdWEB
- www.vulncheck.com/advisories/codewhale-before-remote-code-execution-via-allow-shellnvdWEB
News mentions
0No linked articles in our index yet.