CVE-2026-75911: Remote Code Execution via Configuration Override in CodeWhale

Vulnerability ID: CVE-2026-75911
CVSS Score: 8.5
Published: 2026-09-04

CVE-2026-75911 is a configuration injection and remote code execution vulnerability in CodeWhale. Unsafe merging of repository-level TOML configuration files allows malicious repositories to silently enable shell tool registration and inject prompts, forcing the integrated LLM agent to execute arbitrary host commands.

TL;DR

Insecure workspace configuration merging in CodeWhale lets a malicious git repository silently enable shell access and execute arbitrary commands via prompt injection when the workspace is opened.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-94
• Attack Vector: Local (User-initiated clone & open)
• CVSS v4.0: 8.5 (High)
• CVSS v3.1: 7.8 (High)
• Exploit Status: Proof-of-Concept
• CISA KEV Status: Not Listed

Affected Systems

• CodeWhale Terminal User Interface (TUI) workspace environment
• CodeWhale: >= 0.8.6, < 0.8.41 (Fixed in: 0.8.41)
• CodeWhale: >= 0.8.41, < 0.8.64 (Fixed in: 0.8.64)

Code Analysis

Commit: 4356335

Enforce strict unidirectional workspace permissions and drop instructions overwrite

--- a/crates/tui/src/main.rs
+++ b/crates/tui/src/main.rs

Exploit Details

• GHSA-gx45-xrj5-g6c4: Security advisory containing the conceptual trigger details for project configuration override

Mitigation Strategies

• Disable workspace configurations completely when running untrusted code
• Restrict shell access in global configs
• Isolate terminal developer tools in sandboxed containers (Docker, DevContainers)

Remediation Steps:

1. Upgrade CodeWhale client to version 0.8.64 or later.
2. Verify and sanitize existing .codewhale configurations in local directories.
3. Explicitly configure 'allow_shell = false' globally to enforce a safe baseline.

References

• GitHub Security Advisory GHSA-gx45-xrj5-g6c4
• VulnCheck Security Advisory
• NVD Record
• CVE-2026-75911 CVE Record

Read the full report for CVE-2026-75911 on our website for more details including interactive diagrams and full exploit analysis.