GPU VulnDB

Database/AI/ML frameworks & serving

CodeWhale agent: exec_shell_interact auto-approves, letting injected content drive an approved root shell

CVSS 7.3CVE-2026-75857AI/ML frameworks & servingcurated

Impact

The exec_shell_interact (exec_interact) tool returns ApprovalRequirement::Auto, overriding the default Required approval for code-executing tools. Model-controlled text is therefore written straight to the stdin of a long-running interactive session the operator already approved - a python3 -i REPL, mysql, ssh or sudo -i - with no prompt. Any untrusted content the agent ingests (a fetched web page, an MCP tool result, a file in the repo it is working on) can carry instructions that execute at that session's privilege level. Where these agents are run on build hosts or GPU dev nodes with a sudo shell open, that is host root reached through a document, and the operator sees no approval dialog to refuse.

Who can reach it

No access to the host needed: anyone who can place content where the agent will read it - a page it fetches, a repository file, an MCP server response. Exploitation requires the operator to have an approved interactive session open, which is the normal way the tool is used.

What to do

Upgrade to codewhale / codewhale-tui 0.8.64. The deprecated deepseek-tui crate (npm and crates.io, 0.3.10 through 0.8.41) has no fixed release - remove it. This is a user-space CLI: replacing the binary and restarting the agent is the whole rollout, no node drain. Until then do not leave privileged interactive sessions (sudo -i, root ssh) open to the agent.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-75857https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-g29h-pfmp-qp9rhttps://github.com/Hmbown/CodeWhale/commit/57f3c89471e27ac4032d9791f6885e5d4408c381https://www.vulncheck.com/advisories/codewhale-before-privilege-escalation-via-exec-shell-interact

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.