Description

CodeWhale (packages codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain a remote code execution vulnerability in the rlm_eval tool. The tool's approval_requirement() returns ApprovalRequirement::Auto, which the engine treats as 'never prompt,' causing arbitrary model-supplied Python code to run in a python3 interpreter without consulting the user's configured --approval-policy and without any approval prompt or audit step. An attacker can induce the agent to execute arbitrary code via prompt injection in untrusted content the agent reads (a web page, fetched URL, repository file, or MCP tool result); the companion rlm_open tool can stage such content. Code runs on the user's machine at the user's privilege level. Fixed in 0.8.64.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-18T16:18:21.653Z",
  "pubdate": "2026-08-18T16:18:21.653Z",
  "executiveSummary": "A remote code execution vulnerability exists in the CodeWhale packages (codewhale and codewhale-tui) affecting versions greater than or equal to 0.8.41 and less than 0.8.64. The flaw resides within the rlm_eval tool, where the approval_requirement() function improperly returns ApprovalRequirement::Auto. This misconfiguration instructs the execution engine to treat the operation as 'never prompt', resulting in arbitrary model-supplied Python code being executed inside a python3 interpreter without respecting the user's configured --approval-policy, bypassing all interactive approval prompts and audit steps.\nAn attacker can exploit this vulnerability by leveraging prompt injection techniques within untrusted content read by the agent, such as a web page, fetched URL, repository file, or Model Context Protocol (MCP) tool result. The companion rlm_open tool can be utilized to stage such malicious content. Successful exploitation leads to arbitrary code execution on the host machine running CodeWhale, operating at the user's privilege level. This poses severe risk implications, including complete system compromise, data exfiltration, or unauthorized local resource access upon processing maliciously crafted input.",
  "technicalDetails": "The vulnerability is rooted in the access control and authorization logic of the rlm_eval tool within CodeWhale versions >= 0.8.41 and < 0.8.64. Specifically, the component's approval_requirement() function returns the static evaluation value ApprovalRequirement::Auto. Consequently, the execution engine interprets this return value as a directive to 'never prompt' the user for confirmation.\nThis design flaw causes the engine to bypass the user's explicitly configured --approval-policy settings entirely. When the agent invokes rlm_eval, arbitrary model-supplied Python code is directly dispatched and executed within a local python3 interpreter environment without generating any interactive approval prompt or audit trail step.\nThe step-by-step attack flow proceeds as follows: First, an attacker populates an untrusted data source—such as a malicious web page, a remotely fetched URL, a compromised repository file, or a manipulated Model Context Protocol (MCP) tool result—with a carefully crafted prompt injection payload. The companion rlm_open tool may be used by the agent to stage or ingest this untrusted content into the execution context.\nSecond, the CodeWhale agent processes the ingested content containing the prompt injection. The injected instructions manipulate the underlying model into generating arbitrary Python code designed to perform malicious actions on the host system.\nThird, the model passes the generated code to the vulnerable rlm_eval tool for execution. Because approval_requirement() returns ApprovalRequirement::Auto, the engine executes the payload immediately in the local python3 interpreter without user intervention or policy enforcement.\nFinally, the payload executes successfully on the user's machine under the security context and privilege level of the active user. No authentication requirements, specific network exposures beyond internet access to fetch untrusted content, or prior privileges are needed beyond the user running the vulnerable CodeWhale session."
}