Description

CodeWhale versions >= 0.8.41 and < 0.8.64 contain a vulnerability in the exec_shell_interact (alias exec_interact) tool, whose approval_requirement returns ApprovalRequirement::Auto. This overrides the default Required approval for code-executing tools, so LLM-controlled stdin is written into an already-approved long-running interactive shell (e.g., a python3 -i REPL, mysql, ssh, or sudo -i session) without any approval prompt. An attacker who can inject instructions via untrusted content the agent ingests (a fetched page, MCP result, or repo file) can cause commands to run at the privilege level of that approved process. Fixed in 0.8.64.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-08-18T16:18:21.520Z",
  "pubdate": "2026-08-18T16:18:21.520Z",
  "executiveSummary": "CodeWhale versions 0.8.41 through 0.8.63 contain an authorization bypass vulnerability in the exec_shell_interact (alias exec_interact) tool. The flaw stems from an incorrect implementation within the approval_requirement function, which improperly returns ApprovalRequirement::Auto instead of enforcing the default Required approval mechanism designated for code-executing components. This misconfiguration allows LLM-controlled standard input (stdin) to be written directly into pre-approved, long-running interactive shell sessions—such as python3 -i REPL, mysql, ssh, or sudo -i—without generating any operational approval prompts for the user. An external attacker capable of injecting malicious instructions via untrusted content ingested by the agent, such as a fetched web page, Model Context Protocol (MCP) result, or repository file, can leverage this vector to execute arbitrary commands. The resultant impact includes unauthorized command execution operating directly at the privilege level of the active, approved interactive shell process, introducing severe risk implications regarding system integrity and confidentiality across affected deployments.",
  "technicalDetails": "The vulnerability resides within the CodeWhale execution engine, specifically in the implementation of the exec_shell_interact tool, which is also referenced by its alias exec_interact. The root cause of the security defect is a logic flaw in the approval_requirement method associated with the tool. Rather than maintaining the system-wide security posture that mandates explicit user authorization for code-executing utilities via the Required approval state, the function explicitly returns ApprovalRequirement::Auto. Consequently, the host application treats subsequent operations executed through this interface as implicitly trusted and pre-authorized.\nThe vulnerable component facilitates interaction with long-running interactive shell sessions. These persistent environments include, but are not limited to, active python3 -i Read-Eval-Print Loops (REPL), database interactive terminals like mysql, remote connection sessions via ssh, or elevated privilege contexts such as sudo -i. Because these sessions are typically instantiated once and subsequently maintained in an approved state for efficiency, bypassing the granular input validation checks effectively subverts the trust boundary of the underlying interactive process.\nThe attack flow unfolds through indirect prompt injection and unauthorized input manipulation. An attacker exploits this vulnerability by supplying malicious instructions through untrusted content ingested by the autonomous agent during normal operation. This untrusted content may originate from external vectors, including maliciously crafted fetched web pages, adversarial Model Context Protocol (MCP) tool execution results, or poisoned repository files. Once the agent ingests the malicious text payload, the LLM interprets the injected instructions and formulates inputs directed toward the interactive shell session.\nBecause the exec_shell_interact tool returns ApprovalRequirement::Auto, the maliciously generated commands are written directly into the stdin stream of the already-approved, long-running interactive shell without triggering any user prompt or supervisory review. No special authentication requirements or elevated network exposure are strictly necessary for the attacker beyond the capability to inject text into the agent's context window. The post-exploitation impact allows the attacker to achieve arbitrary command execution at the exact privilege level of the running interactive process, potentially leading to complete system compromise, data exfiltration, or lateral movement depending on the privileges assigned to the active shell session."
}