Skip to content
OpenAdvisories

Product · Hmbown

CodeWhale

13 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-75913

    CodeWhale before 0.8.64 Argument Injection via git_show

    CodeWhale versions >= 0.3.27 and < 0.8.64 (published as deepseek-tui >= 0.3.27 and < 0.8.41 on npm and 0.3.27 through 0.8.41 on crates.io, and as codewhale / codewhale-tui >= 0.8.41 and < 0.8.64) contain an argument injection vulnerability in the git_show too…

    Hmbown CodeWhale deepseek-tui deepseek-tui npm crates.io
  • Critical 9.6
    CVE-2026-45311

    CodeWhale: run_tests Tool Enables RCE via Malicious Repository Without Approval

    CodeWhale is a DeepSeek + MiMo coding agent in terminal. From 0.3.0 to 0.8.23, the run_tests tool executes cargo test in the workspace with ApprovalRequirement::Auto, meaning it runs without any user approval prompt. cargo test compiles and executes arbitrary…

    Hmbown CodeWhale deepseek-tui deepseek-tui npm crates.io
  • Critical 9.6
    CVE-2026-45374

    CodeWhale: task_create Insecure Defaults Enable RCE via Prompt Injection in Project Files

    CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, the task_create tool spawns durable sub-agents that inherit two insecure defaults, allow_shell defaults to true (config.rs:1499: self.allow_shell.unwrap_or(true)) and auto_approve defau…

    Hmbown CodeWhale deepseek-tui crates.io