The vulnerability lies in the task_create tool of CodeWhale, which locally spawns sub‑agents with insecure default settings: allow_shell defaults to true and auto_approve defaults to true. When a user (who must approve the task) accepts a seemingly harmless prompt, the sub‑agent inherits unrestricted shell access and can execute arbitrary commands. This results in a remote code execution flaw that an attacker can exploit to run code with the privileges of the user who approves the task.

Hmbown:CodeWhale, any version prior to 0.8.26. The affected versions are those built before the fix introduced in release 0.8.26.

The CVSS score is 9.6, indicating critical risk. EPSS data is not available, but the absence of this metric does not diminish the severity implied by the CVSS analysis. The exploit requires that an attacker has the ability to trigger and approve a task_create call—typically an authenticated, authorized user. Thus the potential impact is high, and the attack vector is likely local or within a user’s session. This vulnerability is not listed in CISA KEV, but given the critical severity and the straightforward attack path, prompt remediation is strongly recommended.