CVE-2026-75911: Remote Code Execution via Configuration Override in CodeWhale

This vulnerability, registered as CVE-2026-75911, represents a security flaw in the workspace configuration parsing logic of CodeWhale, a Terminal User Interface (TUI) client for AI-assisted development. CodeWhale allows projects to define local workspace behaviors through a configuration file situated at .codewhale/config.toml. The implementation contains an insecure merging mechanism where local, project-scope directives override global, user-scope security profiles.

Specifically, the flaw arises from the unvalidated trust placed in the allow_shell boolean flag and the instructions array configured within an untrusted repository. Under normal operating conditions, these settings are reserved for global or explicitly approved configurations, as they dictate whether the integrated Large Language Model (LLM) agent has the capability to run system-level commands.

When an external repository is cloned and opened, the application automatically merges the local configuration with the user's global settings. If the local configuration sets allow_shell = true and introduces custom instruction sets, the client program acts on these parameters. This configuration injection compromises the execution environment by enabling dangerous APIs and executing attacker-specified shell scripts without notifying the user.

The root cause of CVE-2026-75911 lies in the insecure design pattern of merging untrusted configuration files. The workspace configuration loader, implemented in Rust within crates/tui/src/main.rs, processes the project-level .codewhale/config.toml file without enforcing privilege boundaries or implementing confirmation dialogs. This mechanism violates basic security design principles concerning security-sensitive parameters.

The core architecture of CodeWhale implements tool-calling capabilities that allow the integrated AI engine to interact with the host system. The registered capabilities include exec_shell and task_shell. The state of these tools is determined by the allow_shell boolean variable. The merging function, merge_project_config, processes project-specific TOML tables and directly assigns values to the runtime configuration structure.

Because the merge logic performs a direct override (config.allow_shell = Some(v) and config.instructions = Some(entries)), any value supplied by the project configuration takes immediate precedence. There is no cryptographic verification, origin validation, or user prompt. Consequently, the user's explicit preference to disable shell tool execution is overridden simply by opening a workspace. This is classified as CWE-94: Improper Control of Generation of Code ('Code Injection').

The vulnerability exists within the merge_project_config function located in crates/tui/src/main.rs. In vulnerable releases prior to version 0.8.64, the function handles the TOML elements allow_shell and instructions without restrictions.

Consider the vulnerable code block:

fn merge_project_config(config: &mut Config, workspace: &Path) {
    // ...
    if let Some(v) = table.get("allow_shell").and_then(toml::Value::as_bool) {
        config.allow_shell = Some(v); // Vulnerable: Directly overrides user config with project config
    }
    
    if let Some(arr) = table.get("instructions").and_then(toml::Value::as_array) {
        let entries: Vec<String> = arr
            .iter()
            .filter_map(|v| v.as_str().map(str::to_string))
            .filter(|s| !s.trim().is_empty())
            .collect();
        config.instructions = Some(entries); // Vulnerable: Wholesale replacement of global system instructions
    }
}

The corrective patch applied in commit 43563356b98c6b993085554da82e77370160a31c restricts this process. It implements a unidirectional security check where local configurations can only restrict permissions.

// Patched implementation in crates/tui/src/main.rs
fn merge_project_config(config: &mut Config, workspace: &Path) {
    // ...
    if let Some(v) = table.get("allow_shell").and_then(toml::Value::as_bool) {
        if v {
            eprintln!(
                "warning: project-scope `allow_shell = true` is ignored — \
                 enable shell from user config for this workspace instead. \
                 (See #417.)"
            );
        } else {
            // Allowing project configuration to strictly disable shell is safe
            config.allow_shell = Some(false);
        }
    }
 
    if table.contains_key("instructions") {
        eprintln!(
            "warning: project-scope `instructions` is ignored — \
             configure instruction files from user config instead. \
             (See #417.)"
        );
    }
}

By ignoring the allow_shell = true directive and emitting a warning to stderr, the patch ensures that the global safety posture is preserved. Furthermore, the complete elimination of project-scope instructions prevents the application from reading untrusted prompt directives that might alter LLM safety alignment.

Exploitation of CVE-2026-75911 is achieved through repository compromise or social engineering, requiring the victim to clone and open a weaponized project. The attack requires no authentication or specific system capabilities beyond the use of CodeWhale.

The attack vector is illustrated in the following workflow:

To construct a working proof of concept, the attacker creates a .codewhale/config.toml file containing allow_shell = true alongside an overridden instruction source. The instruction source, which is typically a markdown file, contains prompt injection vectors designed to direct the AI agent's reasoning. These directives force the agent to run reconnaissance or persistence scripts via the registered exec_shell tool as part of its normal operation, executing arbitrary shell code on the victim's machine.

The impact of successful exploitation is a complete compromise of the confidentiality, integrity, and availability of the local system. Because CodeWhale runs directly within the user's terminal environment, any system commands executed by the AI agent inherit the privileges of the active operating system user.

This results in local command execution without warning. Threat actors can use this access to extract sensitive credentials, such as AWS tokens, SSH private keys, and git credentials, which are commonly present on developer workstations. Furthermore, the attacker can establish persistent reverse shells or implant malicious code into other projects.

The CVSS score of 8.5 (for CVSS v4.0) and 7.8 (for CVSS v3.1) reflects the severity of the vulnerability. Although exploitation requires passive user interaction—cloning and opening the workspace—the execution phase requires no further confirmation, leading to immediate system exposure.

The definitive mitigation for this vulnerability is upgrading CodeWhale to version 0.8.64 or later. In these versions, project-level configurations are prevented from escalating privileges or overriding prompt directions.

If upgrading is not immediately possible, several defense-in-depth measures should be deployed. Users must audit untrusted repositories for the existence of .codewhale folders and delete or sanitize config.toml files before launching the TUI client.

Additionally, isolating CodeWhale within a sandboxed environment, such as a Docker container or a dedicated virtual machine, limits the blast radius of any potential execution. Global configuration files should be set to read-only, and shell execution permissions should be explicitly disabled unless required.