What happened
A cluster of five High/Critical CVEs (CVE-2026-75858 CVSS 7.5, CVE-2026-75913 CVSS 9.3, CVE-2026-75911 CVSS 7.8, CVE-2026-75859 CVSS 7.5, CVE-2026-75857 CVSS 7.0) published 2026-08-18 describe systemic approval-bypass and injection flaws in CodeWhale, an AI coding agent, where tool-level approval gates default to 'Auto' for code-execution and shell tools, and repository-supplied configuration files are trusted without validation.
Why it matters
This is a textbook novel agent-execution attack class: prompt injection in content the agent merely reads (not code it's asked to run) leads directly to arbitrary code execution at the user's privilege level, and a malicious repo can achieve the same by simply being cloned and opened — no user interaction with the malicious content required.
Attack vector
The rlm_eval tool's approval_requirement() incorrectly returns ApprovalRequirement::Auto (treated as 'never prompt'), so an attacker can induce the agent via prompt injection in untrusted content it reads (a web page, fetched URL, repository file, or MCP tool result — including via the companion rlm_open tool) to execute arbitrary model-supplied Python code with no user approval, at the user's OS privilege level. Companion CVEs in the same cluster cover git_show argument injection (CVE-2026-75913, CVSS 9.3), auto-approved shell-command interaction (CVE-2026-75857), and malicious .codewhale/config.toml files in cloned repos enabling arbitrary shell execution (CVE-2026-75911) or arbitrary file read (CVE-2026-75859) without any user interaction beyond opening the repo.
Affected systems
CodeWhale / codewhale-tui (AI coding agent), versions >= 0.8.41 and < 0.8.64 (related: CVE-2026-75913, CVE-2026-75911, CVE-2026-75859, CVE-2026-75857)
Mitigation
Upgrade CodeWhale/codewhale-tui to >= 0.8.64; treat all repository-provided config files and prompt-injectable content as untrusted; require explicit per-command approval for code-execution tools.