TI-2026-33165 Aliases CVE-2026-45374 GHSA-72w5-pf8h-xfp4

CodeWhale: task_create Insecure Defaults Enable RCE via Prompt Injection in Project Files

HIGH 76CWE-94Published 2026-05-28 · Updated 2026-05-30

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, the task_create tool spawns durable sub-agents that inherit two insecure defaults, allow_shell defaults to true (config.rs:1499: self.allow_shell.unwrap_or(true)) and auto_approve defaults to true (task_manager.rs:297: auto_approve: Some(true)). When a user approves a task_create call (which requires ApprovalRequirement::Required), they approve what appears to be a benign work prompt. However, the spawned sub-agent silently receives unrestricted, unapproved shell access. This vulnerability is fixed in 0.8.26.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00387 33rd percentileScored 2026-11-07

Fix Fixed CodeWhale (Hmbown): 0.8.26deepseek-tui (crates.io): 0.8.26

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Hmbown	CodeWhale	before 0.8.26	0.8.26	Patch available	CNA
—	deepseek-tui (crates.io)	before 0.8.26	0.8.26	Patch available	GHSA-72w5-pf8h-xfp4

CodeWhale VendorHmbown Affected before 0.8.26 Fixed in 0.8.26 Patch available CNA
deepseek-tui (crates.io) Vendor— Affected before 0.8.26 Fixed in 0.8.26 Patch available GHSA-72w5-pf8h-xfp4

Remediation

Fix · CNA CodeWhale (Hmbown) Fixed in 0.8.26
Fix · GHSA-72w5-pf8h-xfp4 deepseek-tui (crates.io) Fixed in 0.8.26 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-45374
2026-10-03 Alias added: GHSA-72w5-pf8h-xfp4

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-45374

Other 4

TI-2026-53100 CodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOU CVSS 4.0CRITICAL 9.2
TI-2026-53143 CodeWhale before 0.8.64 Environment Variable Leak via js_execution CVSS 4.0HIGH 8.7
TI-2026-33110 CodeWhale: run_tests Tool Enables RCE via Malicious Repository Without Approval CVSS 3.1CRITICAL 9.6
TI-2026-53141 CodeWhale before 0.8.64 Argument Injection via git_show CVSS 4.0HIGH 8.5
TI-2026-53139 CodeWhale before 0.8.64 Remote Code Execution via allow_shell CVSS 4.0HIGH 8.5
TI-2026-53102 CodeWhale rlm_eval before 0.8.64 Remote Code Execution CVSS 4.0HIGH 8.5

See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences