Intelligence
Join the waitlist
AEV-2026-0054

CodeWhale's exec_shell_interact sent model chosen input into an already approved interactive process with no approval check of its own (CVE-2026-75857)

CodeWhale's exec_shell opens an interactive process, such as a shell, a REPL or a database console, and is correctly gated behind a human approval prompt. This entry independently fetched GitHub Security Advisory GHSA-g29h-pfmp-qp9r and confirmed its own stated mechanism: exec_shell_interact, the sibling tool that sends further input into that same already running process, declared ApprovalRequirement::Auto rather than Required, so a human's approval of the decision to open the process was never established, and was never checked, to cover a later, materially different action, model chosen input sent into it afterward. Fixed in v0.8.64, released 22 June 2026, roughly three and a half weeks before the advisory's own 16 July 2026 publication; this entry independently confirmed the fixing commit changes exactly the one declared approval requirement, for exec_shell_interact and, in the identical commit, for a second, sibling interactive execution tool.

AESS 7.2 highConfirmedStatus: publishedEvent: 16 July 2026Approval ControlsExecution Authority

Affected

Organisation
unknown
Product
CodeWhale (began as deepseek-tui; independently maintained, not affiliated with any model provider)
Component
The exec_shell_interact tool's own approval_requirement declaration, confirmed by this entry's own reading of the fixing commit to sit in ShellInteractTool in crates/tui/src/tools/shell.rs, within the npm codewhale and cargo codewhale-tui packages
Versions
This entry confirmed directly from the advisory's own text that npm codewhale and cargo codewhale-tui carry the affected declaration from version 0.8.41 up to but excluding the fixed version 0.8.64, and that the predecessor cargo and npm deepseek-tui packages carry an equivalent affected range, with npm deepseek-tui fixed in 0.8.41. This entry did not independently re-derive the precise upper bound of the affected cargo deepseek-tui range beyond what the primary advisory itself states.
Configurations
Any user of an affected CodeWhale or deepseek-tui version who approves the agent opening an interactive process, such as a shell, a REPL, a database console or an SSH session, for a stated purpose, after which the model can be induced, including by content it reads from an untrusted source, to send further input into that same process through exec_shell_interact

Execution authority facts

Fields the evidence does not establish are shown as unknown rather than guessed.

Intended task
Open an interactive process the user has approved for a stated purpose, then, separately, carry out whatever task the model is pursuing using that already open process
Agent
CodeWhale's own coding agent, specifically its exec_shell_interact tool
Delegating actor
unknown
Action
Model chosen input sent into an already running interactive process through exec_shell_interact, confirmed directly by this entry's own reading of the advisory and the fixing commit to have reached execution with no approval check, since the tool's own approval_requirement declared ApprovalRequirement::Auto
Target resource
The already open interactive process itself, and whatever files, network access, credentials or downstream systems that process's own privileges could reach
Environment
unknown
Credentials used
unknown
Privileges available
Whatever privileges and credentials the already open interactive process held, per the advisory's own stated consequence and its own extension to privileged shells, database consoles authenticated as an administrative user, and active SSH sessions
Authority presented
A human's own earlier approval of the separate, correctly gated exec_shell call that opened the process for a stated purpose
Authority required
Authority over the specific, later input exec_shell_interact actually sent, which this entry's own reading of the advisory and the fixing commit confirms was never separately checked against CodeWhale's own approval policy at all
Applicable policy
unknown
Approval mechanism
A per tool call approval prompt, gated by each tool's own declared ApprovalRequirement, confirmed directly by this entry's own reading of the fixing commit to be the mechanism the fix corrects
Required approver
unknown
Independent approval
no
Action binding
Broken, confirmed directly by this entry's own reading of the advisory and the fixing commit: the approval presented was for a different tool call, opening the process, than the one that executed, sending input into it
Sequence context
The later input reached execution only because an interactive process a separate, correctly gated tool call had already opened remained open and reachable, confirmed by this entry's own reading of the advisory's own stated proof of concept

Impact

Consequence
Arbitrary code or command execution inside the already open interactive process, at whatever privilege that process held, per the advisory's own stated proof of concept and this entry's own confirmation of the ApprovalRequirement::Auto declaration it describes
Reach
single
Reversibility
unknown
Detectability
silent
Propagation
A concrete propagation path exists, whatever the already open process's own privileges and credentials could reach beyond that one process, but this entry did not observe the effect actually spreading to a further system
Recovery
Fixed in version 0.8.64, confirmed directly by this entry's own reading of the fixing commit: exec_shell_interact's own approval_requirement now returns ApprovalRequirement::Required rather than Auto, with ToolCapability::RequiresApproval added to its declared capabilities and a regression test confirming the change, alongside the identical correction applied in the same commit to a second, sibling interactive execution tool.

Evidence

Primary sources

Supporting sources

Reproduction status
Independently confirmed by Moona Intelligence fetching the primary advisory, the GitHub Advisory Database's own mirror, the fixing commit and the fixed release directly, rather than by running CodeWhale itself against a live interactive process. This entry read the advisory's own stated mechanism and proof of concept, then read the fixing commit's own diff and confirmed it changes exactly the one declared approval requirement the advisory names.
Evidence state
Confirmed

Known unknowns

  • Whether this mechanism was exploited against a real user's own session before the fix shipped.
  • Which organization, if any, is entitled to the CVE Numbering Authority credit for CVE-2026-75857; this entry did not independently check cve.org or nvd.nist.gov.
  • The precise upper bound of the affected cargo deepseek-tui version range beyond what the primary advisory itself states.
  • Whether every other interactive or consequential tool CodeWhale exposes, beyond exec_shell_interact and the sibling tool this entry independently confirmed through the identical fixing commit, correctly declares an approval requirement.

Limitations

  • This entry corroborates the sibling rlm_eval advisory, GHSA-wrj3-vj8c-784f, and the remaining seven advisories GitHub's own listing dates to the same 16 July 2026 disclosure through that listing page and, for the sibling tool, this entry's own direct reading of the identical fixing commit, rather than through a direct fetch of each advisory's own page individually.
  • This entry verifies the mechanism by reading the advisory's own stated proof of concept and by reading the fixing commit's own diff directly, rather than by independently reproducing the proof of concept against a running CodeWhale instance, since the exact declaration this entry confirms already establishes the outcome and the fix is already shipped.

Claim provenance

  • verified
    This session fetched the primary advisory directly and confirmed the title, High severity, 16 July 2026 publication date, CWE-269, the affected npm codewhale, cargo codewhale-tui and deepseek-tui version ranges, the fixed versions, and the stated mechanism: exec_shell is correctly gated by approval while exec_shell_interact declared ApprovalRequirement::Auto, reaching no approval check for model chosen input sent into an already running process.
    The Shell Was Approved Once. Everything Typed Into It Was Not.
  • verified
    This session fetched the GitHub Advisory Database's own mirror directly and confirmed CVE-2026-75857 as the formally assigned identifier, a CVSS 4.0 vector of AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N with a base score of 7.3, and that the Database's own record was reviewed and last updated 4 September 2026.
    The Shell Was Approved Once. Everything Typed Into It Was Not.
  • verified
    This session fetched this commit directly and confirmed it changes ShellInteractTool's own approval_requirement in crates/tui/src/tools/shell.rs from ApprovalRequirement::Auto to ApprovalRequirement::Required, adds ToolCapability::RequiresApproval to its declared capabilities, adds a regression test, and applies the identical correction in the same commit to a second, sibling interactive execution tool, RlmEvalTool, in crates/tui/src/tools/rlm.rs.
    The Shell Was Approved Once. Everything Typed Into It Was Not.
  • verified
    This session fetched this release directly and confirmed its own stated date of 22 June 2026, roughly three and a half weeks before the advisory's own 16 July 2026 publication, and confirmed its own release notes state interactive execution surfaces require approval among the security fixes shipped in the identical release.
    The Shell Was Approved Once. Everything Typed Into It Was Not.