Read the docs
TI-2026-33110 Aliases CVE-2026-45311GHSA-wx44-2q6h-j6p8

CodeWhale: run_tests Tool Enables RCE via Malicious Repository Without Approval

Priority HIGH 76CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

CodeWhale is a DeepSeek + MiMo coding agent in terminal. From 0.3.0 to 0.8.23, the run_tests tool executes cargo test in the workspace with ApprovalRequirement::Auto, meaning it runs without any user approval prompt. cargo test compiles and executes arbitrary code: test binaries, build.rs build scripts, and proc macros. While auto-approving test execution is a deliberate design choice, it creates an inconsistency in the security boundary. However, in a malicious repository, test code can execute arbitrary shell commands, exfiltrate credentials, or establish persistence with zero approval. The attack is amplified by AGENTS.md (auto-loaded into the system prompt), which can instruct the model to run tests proactively at session start. This vulnerability is fixed in 0.8.23.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00566 47th percentileScored 2026-11-07
Fix Fixed CodeWhale (Hmbown): 0.8.23deepseek-tui (crates.io): 0.8.23+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HmbownCodeWhale0.3.0 to before 0.8.230.8.23Patch availableCNA
—deepseek-tui (crates.io)0.3.0 to before 0.8.230.8.23Patch availableGHSA-wx44-2q6h-j6p8
—deepseek-tui-cli (crates.io)0.3.0 to before 0.8.230.8.23Patch availableGHSA-wx44-2q6h-j6p8
—deepseek-tui (npm)0.3.0 to before 0.8.230.8.23Patch availableGHSA-wx44-2q6h-j6p8
  • CodeWhale VendorHmbown Affected 0.3.0 to before 0.8.23 Fixed in 0.8.23 Patch available CNA
  • deepseek-tui (crates.io) Vendor— Affected 0.3.0 to before 0.8.23 Fixed in 0.8.23 Patch available GHSA-wx44-2q6h-j6p8
  • deepseek-tui-cli (crates.io) Vendor— Affected 0.3.0 to before 0.8.23 Fixed in 0.8.23 Patch available GHSA-wx44-2q6h-j6p8
  • deepseek-tui (npm) Vendor— Affected 0.3.0 to before 0.8.23 Fixed in 0.8.23 Patch available GHSA-wx44-2q6h-j6p8

Remediation

  • Fix · CNA CodeWhale (Hmbown) Fixed in 0.8.23
  • Fix · GHSA-wx44-2q6h-j6p8 deepseek-tui (crates.io) Fixed in 0.8.23 Advisory →
  • Fix · GHSA-wx44-2q6h-j6p8 deepseek-tui-cli (crates.io) Fixed in 0.8.23 Advisory →
  • Fix · GHSA-wx44-2q6h-j6p8 deepseek-tui (npm) Fixed in 0.8.23 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45311
  2. 2026-10-03 Alias added: GHSA-wx44-2q6h-j6p8
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Advisory 1

Other 4

  • TI-2026-53100 CodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOU CVSS 4.0CRITICAL 9.2
  • TI-2026-53143 CodeWhale before 0.8.64 Environment Variable Leak via js_execution CVSS 4.0HIGH 8.7
  • TI-2026-33165 CodeWhale: task_create Insecure Defaults Enable RCE via Prompt Injection in Project Files CVSS 3.1CRITICAL 9.6
  • TI-2026-53141 CodeWhale before 0.8.64 Argument Injection via git_show CVSS 4.0HIGH 8.5
  • TI-2026-53139 CodeWhale before 0.8.64 Remote Code Execution via allow_shell CVSS 4.0HIGH 8.5
  • TI-2026-53102 CodeWhale rlm_eval before 0.8.64 Remote Code Execution CVSS 4.0HIGH 8.5
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences