CodeWhale's run_tests tool automatically runs cargo test without prompting the user. Cargo test compiles and executes test binaries, build.rs scripts, and proc macros, which allow test code to run arbitrary shell commands. A repository containing malicious test code can thus cause an attacker to execute commands, exfiltrate credentials, or establish persistence on the host. This flaw is an example of CWE‑94. The consequence is that a compromised repository can give an attacker full code execution on the system running CodeWhale, compromising confidentiality, integrity, and availability.

The vulnerability affects Hmbown:CodeWhale versions from 0.3.0 up to but not including 0.8.23. It has been fixed in release 0.8.23 and all subsequent versions. Users should verify the version in use and upgrade if necessary.

The CVSS score of 9.6 reflects a highly severe risk. An attacker can supply a malicious repository that contains exploit code in its tests; because run_tests auto‑approves execution, no user interaction is required. The EPSS score is not available and the vulnerability is not in the CISA KEV catalog, indicating that widespread exploitation has not yet been observed. Nonetheless, the design of the tool makes exploitation straightforward for anyone who can place a repository into CodeWhale’s workspace, so the risk is considered high.