{"uuid": "d7814e3d-a5c8-41c1-875d-7bd66f07d5e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75911", "type": "seen", "source": "https://gist.github.com/alon710/bb4cbf99c94a659593e6b177ff58789d", "content": "# CVE-2026-75911: CVE-2026-75911: Remote Code Execution via Configuration Override in CodeWhale\n\n> **CVSS Score:** 8.5\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-75911\n\n## Summary\nCVE-2026-75911 is a configuration injection and remote code execution vulnerability in CodeWhale. Unsafe merging of repository-level TOML configuration files allows malicious repositories to silently enable shell tool registration and inject prompts, forcing the integrated LLM agent to execute arbitrary host commands.\n\n## TL;DR\nInsecure workspace configuration merging in CodeWhale lets a malicious git repository silently enable shell access and execute arbitrary commands via prompt injection when the workspace is opened.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94\n- **Attack Vector**: Local (User-initiated clone & open)\n- **CVSS v4.0**: 8.5 (High)\n- **CVSS v3.1**: 7.8 (High)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- CodeWhale Terminal User Interface (TUI) workspace environment\n- **CodeWhale**: >= 0.8.6, < 0.8.41 (Fixed in: `0.8.41`)\n- **CodeWhale**: >= 0.8.41, < 0.8.64 (Fixed in: `0.8.64`)\n\n## Mitigation\n\n- Disable workspace configurations completely when running untrusted code\n- Restrict shell access in global configs\n- Isolate terminal developer tools in sandboxed containers (Docker, DevContainers)\n\n**Remediation Steps:**\n1. Upgrade CodeWhale client to version 0.8.64 or later.\n2. Verify and sanitize existing .codewhale configurations in local directories.\n3. Explicitly configure 'allow_shell = false' globally to enforce a safe baseline.\n\n## References\n\n- [GitHub Security Advisory GHSA-gx45-xrj5-g6c4](https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-gx45-xrj5-g6c4)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/codewhale-before-remote-code-execution-via-allow-shell)\n- [NVD Record](https://nvd.nist.gov/vuln/detail/CVE-2026-75911)\n- [CVE-2026-75911 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-75911)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-75911) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T19:31:35.022727Z"}