CodeWhale versions between 0.8.41 and 0.8.63 contain a flaw in the exec_shell_interact tool that allows the approval check to automatically approve execution. Because the tool accepts LLM‑controlled stdin and writes it into an already approved interactive shell, an attacker who can inject untrusted content into the agent can execute commands at the privilege level of that long‑running shell session. This can lead to unauthorized code execution and gain of privileges beyond the intended environment.

The affected product is CodeWhale from Hmbown. Vulnerable versions are 0.8.41 through 0.8.63; the issue was fixed in version 0.8.64.

The vulnerability carries a CVSS score of 7.3 and is not listed in the CISA KEV catalog, with no EPSS data available. Based on the description, the likely attack vector requires that the attacker can influence content ingestion, either locally or by sending malicious data that the agent processes. Once the untrusted input reaches exec_shell_interact, it can be executed directly in an interactive shell such as python, mysql, ssh, or sudo, thereby enabling privilege escalation within the scope of that process.