CVE-2026-75911

Name of the Vulnerable Software and Affected Versions CodeWhale versions prior to 0.8.64

Description Insufficient validation of the allow shell configuration parameter within project config files allows for arbitrary shell command execution. An attacker can achieve this by committing a malicious .codewhale/config.toml file to a repository. When a user clones and opens the affected repository, the AI model is granted access to the exec shell and task shell tools, which enables the execution of arbitrary shell commands on the victim's machine without explicit consent.

Recommendations Update to version 0.8.64 or later.