Is CVE-2026-75911 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-75911?

CVE-2026-75911 has a CVSS v3 severity of HIGH (7.8).

Back

CVE-2026-75911

Description

CodeWhale versions before 0.8.64 fail to properly validate the allow_shell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a malicious .codewhale/config.toml file to a repository. When a user clones and opens the repository in CodeWhale, the AI model gains access to exec_shell and task_shell tools, enabling execution of arbitrary shell commands on the victim's machine without explicit user consent.