https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T10:54:56.510516+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-75911 CVE-2026-75911 — CodeWhale before 0.8.64 Remote Code Execution via allow_shell 2026-10-06T10:54:56.528084+00:00

Affected: Hmbown CodeWhale

CodeWhale versions before 0.8.64 fail to properly validate the allow_shell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a malicious .codewhale/config.toml file to a repository. When a user clones and opens the repository in CodeWhale, the AI model gains access to exec_shell and task_shell tools, enabling execution of arbitrary shell commands on the victim's machine without explicit user consent.