CVE-2026-45374

Name of the Vulnerable Software and Affected Versions CodeWhale versions prior to 0.8.26

Description The task create tool spawns durable sub-agents that inherit insecure default settings. Specifically, the allow shell variable defaults to true and the auto approve variable defaults to true. When a user approves a task create call, they may believe they are only approving a benign work prompt. However, the resulting sub-agent silently receives unrestricted and unapproved shell access. This allows the sub-agent to execute shell commands without further user intervention, potentially following malicious instructions embedded in project files.

Recommendations Update to version 0.8.26.