fkie_cve-2026-75858

CodeWhale (packages codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain a remote code execution vulnerability in the rlm_eval tool. The tool's approval_requirement() returns ApprovalRequirement::Auto, which the engine treats as 'never prompt,' causing arbitrary model-supplied Python code to run in a python3 interpreter without consulting the user's configured --approval-policy and without any approval prompt or audit step. An attacker can induce the agent to execute arbitrary code via prompt injection in untrusted content the agent reads (a web page, fetched URL, repository file, or MCP tool result); the companion rlm_open tool can stage such content. Code runs on the user's machine at the user's privilege level. Fixed in 0.8.64.

GHSA-wrj3-vj8c-784f — CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE)

Affected: crates.io: deepseek-tui, npm: deepseek-tui, crates.io: codewhale-tui, npm: codewhale

### Maintainer resolution

The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 57f3c89471e27ac4032d9791f6885e5d4408c381. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below.

### Summary The `rlm_eval` tool runs an arbitrary Python string chosen by the model in a real `python3` interpreter. Its `approval_requirement()` returns `ApprovalRequirement::Auto`, which the engine treats as "never prompt," regardless of the user's configured `--approval-policy`. A single tool call — which prompt injection from any untrusted content the agent reads (a web page, a fetched URL, a repo file, an MCP tool result) can induce — runs code on the user's machine at the user's privilege with no prompt and no audit step. This is the same defect that was already patched on the sibling `run_tests` tool (CVE-2026-45311); the fix never reached `rlm_eval` or `rlm_open`, which expose a broader surface (full Python on the host, not just `cargo test`).

### Details `rlm_eval`'s `execute()` reads the LLM-controlled `code` field and runs it (`crates/tui/src/tools/rlm.rs:215-300`):

```rust fn capabilities(&self) -> Vec<ToolCapability> { vec![ToolCapability::Network, ToolCapability::ExecutesCode] }

fn approval_requirement(&self) -> ApprovalRequirement { ApprovalRequirement::Auto // overrides the safe default below }

async fn execute(&self, input:…

Most recent entries from all

fkie_cve-2026-75858

GHSA-wrj3-vj8c-784f — CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE)