{"id":"GHSA-g29h-pfmp-qp9r","revision":null,"records":[{"revision":"9d362476cef74a2e8db9efd2ce248990","observedAt":"2026-10-29T22:48:55.035+00:00","statement":{"source":"cve-program","id":"CVE-2026-75857","aliases":[],"title":"CodeWhale before 0.8.64 Privilege Escalation via exec_shell_interact","description":"CodeWhale versions >= 0.3.10 and < 0.8.64 (published as deepseek-tui >= 0.3.10 and < 0.8.41 on npm and 0.3.10 through 0.8.41 on crates.io, and as codewhale / codewhale-tui >= 0.8.41 and < 0.8.64) contain a vulnerability in the exec_shell_interact (alias exec_interact) tool, whose approval_requirement returns ApprovalRequirement::Auto. This overrides the default Required approval for code-executing tools, so LLM-controlled stdin is written into an already-approved long-running interactive shell (e.g., a python3 -i REPL, mysql, ssh, or sudo -i session) without any approval prompt. An attacker who can inject instructions via untrusted content the agent ingests (a fetched page, MCP result, or repo file) can cause commands to run at the privilege level of that approved process. Fixed in codewhale / codewhale-tui 0.8.64; the deprecated deepseek-tui crate has no fixed release.","state":0,"publishedAt":"2026-08-18T15:21:56.357+00:00","modifiedAt":"2026-10-29T21:16:54.116+00:00","affected":[{"ecosystem":"Vendor product","name":"CodeWhale","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Hmbown\",\n                    \"product\": \"CodeWhale\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:cargo/deepseek-tui\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0.3.10\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThanOrEqual\": \"0.8.41\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"CodeWhale","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Hmbown\",\n                    \"product\": \"CodeWhale\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:npm/deepseek-tui\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0.3.10\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"0.8.41\"\n                        },\n                        {\n                            \"version\": \"0.8.41\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"CodeWhale","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Hmbown\",\n                    \"product\": \"CodeWhale\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:cargo/codewhale-tui\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0.8.41\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"0.8.64\"\n                        },\n                        {\n                            \"version\": \"0.8.64\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"CodeWhale","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Hmbown\",\n                    \"product\": \"CodeWhale\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:npm/codewhale\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0.8.41\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"0.8.64\"\n                        },\n                        {\n                            \"version\": \"0.8.64\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":7.3,"severity":"HIGH"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7,"severity":"HIGH"}],"references":["https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-g29h-pfmp-qp9r","https://github.com/Hmbown/CodeWhale/commit/57f3c89471e27ac4032d9791f6885e5d4408c381","https://www.vulncheck.com/advisories/codewhale-before-privilege-escalation-via-exec-shell-interact"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-75857","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-75857","identifiers":["CVE-2026-75857"]},"retained":false,"historicalAffected":[]},{"revision":"71ab7e61214841958dad28c33eb89002","observedAt":"2026-11-05T13:43:37.075+00:00","statement":{"source":"euvd","id":"EUVD-2026-60964","aliases":["CVE-2026-75857","GHSA-g29h-pfmp-qp9r"],"title":"CodeWhale versions >= 0.3.10 and < 0.8.64 (published as deepseek-tui >= 0.3.10 and < 0.8.41 on npm and 0.3.10 through 0.8.41 on crates.io, and as codewhale / codewhale-tui >= 0.8.41 and < 0.8.64) contain a vulnerability in the exec_shell_in…","description":"CodeWhale versions >= 0.3.10 and < 0.8.64 (published as deepseek-tui >= 0.3.10 and < 0.8.41 on npm and 0.3.10 through 0.8.41 on crates.io, and as codewhale / codewhale-tui >= 0.8.41 and < 0.8.64) contain a vulnerability in the exec_shell_interact (alias exec_interact) tool, whose approval_requirement returns ApprovalRequirement::Auto. This overrides the default Required approval for code-executing tools, so LLM-controlled stdin is written into an already-approved long-running interactive shell (e.g., a python3 -i REPL, mysql, ssh, or sudo -i session) without any approval prompt. An attacker who can inject instructions via untrusted content the agent ingests (a fetched page, MCP result, or repo file) can cause commands to run at the privilege level of that approved process. Fixed in codewhale / codewhale-tui 0.8.64; the deprecated deepseek-tui crate has no fixed release.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":7.3,"severity":null}],"references":["https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-g29h-pfmp-qp9r","https://github.com/Hmbown/CodeWhale/commit/57f3c89471e27ac4032d9791f6885e5d4408c381","https://www.vulncheck.com/advisories/codewhale-before-privilege-escalation-via-exec-shell-interact"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-60964","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 18, 2026, 3:21:56 PM","dateUpdated":"Oct 29, 2026, 9:16:54 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-60964","identifiers":["EUVD-2026-60964","CVE-2026-75857","GHSA-g29h-pfmp-qp9r"]},"retained":false,"historicalAffected":[]},{"revision":"a84ec039274d4cf399b52928ee59af6f","observedAt":"2026-10-31T19:04:57.61+00:00","statement":{"source":"nvd","id":"CVE-2026-75857","aliases":[],"title":"CodeWhale versions >= 0.3.10 and < 0.8.64 (published as deepseek-tui >= 0.3.10 and < 0.8.41 on npm and 0.3.10 through 0.8.41 on crates.io, and as codewhale / codewhale-tui >= 0.8.41 and < 0.8.64) contain a vulnerability in the exec_shell_in…","description":"CodeWhale versions >= 0.3.10 and < 0.8.64 (published as deepseek-tui >= 0.3.10 and < 0.8.41 on npm and 0.3.10 through 0.8.41 on crates.io, and as codewhale / codewhale-tui >= 0.8.41 and < 0.8.64) contain a vulnerability in the exec_shell_interact (alias exec_interact) tool, whose approval_requirement returns ApprovalRequirement::Auto. This overrides the default Required approval for code-executing tools, so LLM-controlled stdin is written into an already-approved long-running interactive shell (e.g., a python3 -i REPL, mysql, ssh, or sudo -i session) without any approval prompt. An attacker who can inject instructions via untrusted content the agent ingests (a fetched page, MCP result, or repo file) can cause commands to run at the privilege level of that approved process. Fixed in codewhale / codewhale-tui 0.8.64; the deprecated deepseek-tui crate has no fixed release.","state":0,"publishedAt":"2026-08-18T16:18:21.52+00:00","modifiedAt":"2026-10-29T21:17:33.107+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":7.3,"severity":"HIGH"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7,"severity":"HIGH"}],"references":["https://github.com/Hmbown/CodeWhale/commit/57f3c89471e27ac4032d9791f6885e5d4408c381","https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-g29h-pfmp-qp9r","https://www.vulncheck.com/advisories/codewhale-before-privilege-escalation-via-exec-shell-interact"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75857","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-269"],"productCriteria":[],"sourceDates":{"published":"2026-08-18T16:18:21.520","lastModified":"2026-10-29T21:17:33.107"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-75857","identifiers":["CVE-2026-75857"]},"retained":false,"historicalAffected":[]},{"revision":"86cc7578e9b44ed9b8b05cccc89e4352","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-g29h-pfmp-qp9r","aliases":["CVE-2026-75857"],"title":"CodeWhale: exec_shell_interact sends LLM-controlled input to a running shell without an approval prompt (privilege escalation)","description":"### Maintainer resolution\n\nThe CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 57f3c89471e27ac4032d9791f6885e5d4408c381. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below.\n\n### Summary\n`exec_shell` is correctly approval-gated. Its sibling `exec_shell_interact` returns `ApprovalRequirement::Auto`, so when the model writes input into a shell the user already approved (a `python3 -i` REPL, `mysql`, `ssh`, `sudo -i`, etc.), no prompt fires. Inside those processes, \"stdin\" is the command surface, so the model gets to run commands at whatever privilege that process holds. The user approved opening the shell once, for a stated purpose; the input that then runs in it is chosen by the model, and can be steered by any prompt injection the agent ingests afterward.\n\n### Details\nThe vulnerability requires two ordinary preconditions: shell tools are enabled (the normal config for using CodeWhale as a coding agent), and the session already has one approved long-running interactive process. After that, any untrusted content the agent reads can drive a `exec_shell_interact` call.\n\n`crates/tui/src/tools/shell.rs:2834-2910`:\n\n```rust\nfn capabilities(&self) -> Vec<ToolCapability> {\n    vec![ToolCapability::ExecutesCode]\n}\n\nfn approval_requirement(&self) -> ApprovalRequirement {\n    ApprovalRequirement::Auto          // overrides the Required-for-ExecutesCode default\n}\n\nasync fn execute(&self, input: Value, context: &ToolContext) -> Result<ToolResult, ToolError> {\n    let task_id = required_task_id(&input)?;\n    let close_stdin = optional_bool(&input, \"close_stdin\", false);\n    let interaction_input = input\n        .get(\"input\").or_else(|| input.get(\"stdin\")).or_else(|| input.get(\"data\"))  // LLM-controlled\n        .and_then(serde_json::Value::as_str).unwrap_or(\"\");\n    {\n        let mut manager = context.shell_manager.lock()...;\n        if !interaction_input.is_empty() || close_stdin {\n            manager.write_stdin(task_id, interaction_input, close_stdin)...;          // no prompt\n        }\n    }\n    ...\n}\n```\n\nSame gate as the `rlm_eval` finding: the `Auto` at `approval_requirement()` makes `approval_required` false at `engine.rs:845`, so the `--approval-policy` is never consulted for the stdin write. The trait default at `spec.rs:632` would have been `Required`. The tool is registered unconditionally (`registry.rs:527`), and an alias `exec_interact` on the same struct is registered at `registry.rs:530`, so a fix must cover both names (it does, since they share `ShellInteractTool`).\n\n### PoC\n1. User asks the agent to open a REPL; the model calls `exec_shell command=\"python3 -i\"`; the user sees and approves it once.\n2. Later in the session, untrusted content (a fetched page, an MCP result, a repo `AGENTS.md`) instructs the model to send a payload to the open REPL.\n3. The model calls `exec_shell_interact task_id=<repl> input=\"import os; os.system('...')\\n\"`. No prompt fires; Python runs it.\n\nDriving the interactive TUI through a pty and scanning the output for an approval dialog shows the only `Approval needed:` lines are for the initial `exec_shell`; `exec_shell_interact` never produces one, while a sentinel file proves the injected input ran.\n\nWhen the approved process is privileged, the reach scales with it: `mysql -u root` becomes arbitrary SQL, `ssh host` becomes commands on the remote host, `sudo -i` becomes root — none re-prompted.\n\n### Impact\nCode or command execution inside an already-approved process, at that process's privilege level, with no prompt for the escalating input. Lower severity than the `rlm_eval` finding because it needs a prior user approval of an interactive shell, but higher reach when that shell is privileged.\n\n### Credit\n\n[sai-sh](https://github.com/sai-sh)","state":0,"publishedAt":"2026-09-04T18:02:10+00:00","modifiedAt":"2026-09-04T19:00:04.2766204+00:00","affected":[{"ecosystem":"crates.io","name":"deepseek-tui","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.3.10"},{"kind":"last_affected","version":"0.8.41"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"deepseek-tui","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.3.10"},{"kind":"fixed","version":"0.8.41"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"crates.io","name":"codewhale-tui","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.8.41"},{"kind":"fixed","version":"0.8.64"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"codewhale","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.8.41"},{"kind":"fixed","version":"0.8.64"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-g29h-pfmp-qp9r","https://nvd.nist.gov/vuln/detail/CVE-2026-75857","https://github.com/Hmbown/CodeWhale/commit/57f3c89471e27ac4032d9791f6885e5d4408c381","https://github.com/Hmbown/CodeWhale","https://www.vulncheck.com/advisories/codewhale-before-privilege-escalation-via-exec-shell-interact"],"sourceUrl":"https://github.com/advisories/GHSA-g29h-pfmp-qp9r","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-g29h-pfmp-qp9r","identifiers":["GHSA-g29h-pfmp-qp9r","CVE-2026-75857"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T01:26:54.7341767+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T01:26:54.7341767+00:00","lastSuccessAt":"2026-11-07T01:26:54.8876863+00:00","error":null,"lastVerifiedAt":"2026-11-07T01:26:54.8876872+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-e3f76855f3f449c8c0427e4ebd06d00838fa519af10fe158fc0ca4a62af0718a-340a45d9017d4f9de046b855ad9d1afbc5c699f0e6a7003981ff3a54ebedd5b3","complete":true,"records":420470,"lastAttemptAt":"2026-11-07T01:26:54.2134599+00:00","lastSuccessAt":"2026-11-06T23:27:15.9170833+00:00","error":"InvalidOperationException","lastVerifiedAt":"2026-11-07T00:26:54.2874398+00:00","snapshotPublishedAt":"2026-11-06T23:24:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-1e21f19531e44b2e94a04caf6ae93614","complete":true,"records":13623,"lastAttemptAt":"2026-11-07T01:38:26.744654+00:00","lastSuccessAt":"2026-11-07T01:38:26.741+00:00","error":null,"lastVerifiedAt":"2026-11-07T01:38:26.741+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T01:26:54.7341767+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T01:26:54.7341767+00:00","lastSuccessAt":"2026-11-07T01:26:54.8884513+00:00","error":null,"lastVerifiedAt":"2026-11-07T01:26:54.8884516+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-34343b4ea57e47c5a482c8fcf20a381e","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T01:26:55.9490879+00:00","lastSuccessAt":"2026-11-07T01:26:55.938+00:00","error":null,"lastVerifiedAt":"2026-11-07T01:26:55.938+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T01:26:54.5768376+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T01:26:54.5768376+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T01:26:54.3688172+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T01:26:54.3688172+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T01:26:54.6823337+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T01:26:54.6823337+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-a0b728bc1c5526b5429930c00621636eba8655069c176697c3080f8377619ad7","complete":true,"records":231291,"lastAttemptAt":"2026-11-07T01:26:54.4691469+00:00","lastSuccessAt":"2026-11-07T00:28:51.1983528+00:00","error":null,"lastVerifiedAt":"2026-11-07T01:26:54.4691469+00:00","snapshotPublishedAt":"2026-11-06T23:33:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}