CodeWhale versions from 0.3.10 up to, but not including, 0.8.64, as well as the deprecated deepseek‑tui packages (0.3.10 through 0.8.41 on npm and crates.io, and codewhale‑tui 0.8.41 through 0.8.63), contain a flaw in the exec_shell_interact tool that allows the approval check to automatically approve execution. Because the tool accepts LLM‑controlled stdin and writes it into an already approved interactive shell, an attacker who can inject untrusted content into the agent can execute commands at the privilege level of that long‑running shell session. This can lead to unauthorized code execution and gain of privileges beyond the intended environment.

The affected product is CodeWhale from Hmbown, including the codewhale‑tui distribution and the deprecated deepseek‑tui packages. Vulnerable versions are those from 0.3.10 up to, but not including, 0.8.64; the issue was fixed in codewhale‑tui 0.8.64. The deepseek‑tui crate has no fixed release.

The vulnerability carries a CVSS score of 7.3 and a very low EPSS score of < 1 %, and is not listed in the CISA KEV catalog. Based on the description, the likely attack vector requires that the attacker can influence content ingestion, either locally or by sending malicious data that the agent processes. Once the untrusted input reaches exec_shell_interact, it can be executed directly in an interactive shell such as python, mysql, ssh, or sudo, thereby enabling privilege escalation within the scope of that process.