{"id":"CVE-2026-45374","revision":"03ee2bf6dcaa40c6aaf4bf78ed4858d2","records":[{"revision":"03ee2bf6dcaa40c6aaf4bf78ed4858d2","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-45374","aliases":[],"title":"CodeWhale: task_create Insecure Defaults Enable RCE via Prompt Injection in Project Files","description":"CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, the task_create tool spawns durable sub-agents that inherit two insecure defaults, allow_shell defaults to true (config.rs:1499: self.allow_shell.unwrap_or(true)) and auto_approve defaults to true (task_manager.rs:297: auto_approve: Some(true)). When a user approves a task_create call (which requires ApprovalRequirement::Required), they approve what appears to be a benign work prompt. However, the spawned sub-agent silently receives unrestricted, unapproved shell access. This vulnerability is fixed in 0.8.26.","state":0,"publishedAt":"2026-05-28T17:26:42.979+00:00","modifiedAt":"2026-05-30T02:04:52.694+00:00","affected":[{"ecosystem":"Vendor product","name":"CodeWhale","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Hmbown\",\n                    \"product\": \"CodeWhale\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.8.26\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","score":9.6,"severity":"CRITICAL"}],"references":["https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-72w5-pf8h-xfp4","https://github.com/Hmbown/DeepSeek-TUI/releases/tag/v0.8.26"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-45374","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-45374","identifiers":["CVE-2026-45374"]},"retained":false,"historicalAffected":[]}],"coverage":[]}