Description
CodeWhale versions before 0.8.64 fail to properly validate the allow_shell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a malicious .codewhale/config.toml file to a repository. When a user clones and opens the repository in CodeWhale, the AI model gains access to exec_shell and task_shell tools, enabling execution of arbitrary shell commands on the victim's machine without explicit user consent.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Hmbown | CodeWhale | 0.8.6 – < 0.8.41, 0.8.41 – < 0.8.64 | 0.8.41 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | codewhale-tui | >= 0.8.41, < 0.8.64 | 0.8.64 | GHSA-gx45-xrj5-g6c4 |
| crates.io | deepseek-tui | >= 0.8.6, <= 0.8.41 | — | GHSA-gx45-xrj5-g6c4 |
| npm | codewhale | >= 0.8.41, < 0.8.64 | 0.8.64 | GHSA-gx45-xrj5-g6c4 |
| npm | deepseek-tui | >= 0.8.6, < 0.8.41 | 0.8.41 | GHSA-gx45-xrj5-g6c4 |
References
- GitHub Security Advisory (GHSA-gx45-xrj5-g6c4) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: CodeWhale before 0.8.64 Remote Code Execution via allow_shell third-party-advisory