CVE-2026-75911: CodeWhale: Project config `allow_shell` override enables arbitrary shell command execution via cloned repository
A malicious .codewhale/config.toml or .deepseek/config.toml committed to a repository can silently set allow_shell = true for any user who clones and opens the repository in CodeWhale. This enables the AI model’s exec_shell tool, granting arbitrary shell command execution on the victim’s machine without the user’s explicit opt-in. The approval_policy and sandbox_mode fields correctly enforce tightening-only semantics from project config, but allow_shell has no such guard, contradicting the intent of GHSA-72w5-pf8h-xfp4 which established allow_shell as an opt-in security boundary.
References
- github.com/Hmbown/CodeWhale/commit/43563356b98c6b993085554da82e77370160a31c
- github.com/Hmbown/CodeWhale/security/advisories/GHSA-gx45-xrj5-g6c4
- github.com/advisories/GHSA-gx45-xrj5-g6c4
- nvd.nist.gov/vuln/detail/CVE-2026-75911
- www.vulncheck.com/advisories/codewhale-before-remote-code-execution-via-allow-shell
Code Behaviors & Features
Detect and mitigate CVE-2026-75911 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →