CodeWhale’s rlm_eval component, in versions greater than or equal to 0.8.41 and less than 0.8.64, returns an automatic approval requirement that the engine interprets as “never prompt.” This allows any Python code supplied by the model to execute in a python3 interpreter with no approval prompt or audit. The flaw is a classic instance of untrusted code execution, classified as CWE‑94.

The flaw affects the CodeWhale packages "codewhale" and "codewhale‑tui" shipped by Hmbown. All releases with a version number ≥ 0.8.41 and < 0.8.64 are impacted. The vulnerability is exercised by the rlm_eval and rlm_open tools, which can stage untrusted content such as web pages, fetched URLs, or repository files.

The issue carries a CVSS score of 8.5, indicating a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an attacker directing the agent to process untrusted content that triggers prompt injection; the code then runs at the user’s privilege level. No additional preconditions beyond providing such content are required, making the risk of exploitation significant for users who run CodeWhale with the default auto‑approval policy.