Sai-Sh

**Name of the Vulnerable Software and Affected Versions** CodeWhale versions 0.8.41 through 0.8.63 **Description** The `exec shell interact()` (alias `exec interact()`) tool incorrectly returns `ApprovalRequirement::Auto` for its approval requirement. This behavior overrides the default required approval for tools that execute code, allowing LLM-controlled standard input (stdin) to be written into an already-approved long-running interactive shell, such as a `python3 -i` REPL, `mysql`, `ssh`, or `sudo -i` session, without prompting for approval. An attacker can exploit this by injecting instructions through untrusted content ingested by the agent, such as a fetched page, MCP result, or repository file, leading to command execution at the privilege level of the approved process. **Recommendations** Update CodeWhale to version 0.8.64. As a temporary workaround, restrict the use of the `exec shell interact()` function until the update is applied.

**Name of the Vulnerable Software and Affected Versions** CodeWhale versions 0.8.41 through 0.8.63 **Description** A remote code execution issue exists in the `rlm eval` tool. The `approval requirement()` function returns `ApprovalRequirement::Auto`, which the engine interprets as a command to never prompt the user. This allows arbitrary Python code supplied by a model to execute in a `python3` interpreter, bypassing the configured `--approval-policy` and omitting any approval prompt or audit step. An attacker can trigger this by using prompt injection within untrusted content read by the agent, such as web pages, fetched URLs, repository files, or MCP tool results. The `rlm open` tool can be used to stage this content. The executed code runs on the local machine with the privileges of the user. **Recommendations** Update to version 0.8.64.

**Name of the Vulnerable Software and Affected Versions** CodeWhale versions prior to 0.8.64 **Description** Insufficient validation of file paths in the project config instructions field allows for the reading of arbitrary files on a system. An attacker can use a malicious `.codewhale/config.toml` file within a cloned repository to specify paths outside the workspace. These files are then read and injected into the AI system prompt, which can be used for data exfiltration. **Recommendations** Update to version 0.8.64 or later.

**Name of the Vulnerable Software and Affected Versions** PraisonAI versions prior to 0.1.7 **Description** An authorization bypass occurs because the software fails to validate that the `project id` provided in the request bodies for creating and updating issues belongs to the workspace specified in the URL. This allows an attacker to create issues that reference projects from different workspaces, leading to cross-tenant data pollution within project statistics aggregation. **Recommendations** Update PraisonAI to version 0.1.7 or later.