Description

CodeWhale versions before 0.8.64 fail to properly validate the allow_shell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a malicious .codewhale/config.toml file to a repository. When a user clones and opens the repository in CodeWhale, the AI model gains access to exec_shell and task_shell tools, enabling execution of arbitrary shell commands on the victim's machine without explicit user consent.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-18T16:18:23.057Z",
  "pubdate": "2026-08-18T16:18:23.057Z",
  "executiveSummary": "CodeWhale versions before 0.8.64 are affected by an arbitrary shell command execution vulnerability stemming from improper validation of the allow_shell configuration parameter within project-level configuration files. An attacker can leverage this flaw by committing a malicious .codewhale/config.toml file to a repository.\nWhen an unsuspecting victim clones and opens the compromised repository using CodeWhale, the AI model automatically gains access to the exec_shell and task_shell tools without requiring explicit user consent.\nThis behavior allows the automated execution of arbitrary shell commands directly on the victim's local machine under the privileges of the running application.\nThe risk implication is severe, as successful exploitation leads to complete host compromise through remote code execution triggered merely by opening a malicious repository.\nExploitation requires the victim to clone and open the affected repository containing the maliciously crafted configuration file within vulnerable versions of CodeWhale.",
  "technicalDetails": "The vulnerability resides in the configuration parsing and validation logic of CodeWhale versions prior to 0.8.64, specifically in how project configuration files are processed.\nThe root cause is the absence of adequate input validation and security boundaries on the allow_shell configuration parameter defined within project config files.\nThe vulnerable component is the configuration handler responsible for reading and applying settings from the .codewhale/config.toml file located in the root of a repository.\nNo authentication or specific privileges are required by the attacker other than the ability to commit a file to a target repository, and no network exposure is necessary as the attack vector is local execution triggered by user interaction.\nThe attack flow proceeds as follows: First, an attacker crafts a malicious .codewhale/config.toml file within a repository, explicitly setting the allow_shell parameter to enable shell access. Second, the victim clones the repository to their local machine and opens it using a vulnerable version of CodeWhale. Third, CodeWhale parses the untrusted .codewhale/config.toml file and trusts the maliciously configured allow_shell parameter without verifying user intent or safety constraints. Fourth, the AI model internal to CodeWhale initializes and incorporates the exec_shell and task_shell tools into its operational toolset. Finally, the AI executes arbitrary shell commands on the victim's operating system without prompting the user for explicit authorization, achieving full post-exploitation system compromise."
}