CVE-2026-83816CVSS 8.1Interactive shell approval bypass
The read-only classifier overlooks flags that let fd, rg and git grep launch programs.
CodeWhale fixes two approval bypasses in shell commands and scheduled jobs
CodeWhale 0.9.0 fixes two flaws. Crafted tool calls can skip shell approval in the default interactive Agent profile. An approved recurring job that omits auto_approve can run later tool calls without prompts.
- Disclosed
- Nov 12, 2026
- Public disclosure date
- Severity
- CVSS 8.1 × 1
- 2 CVEs tracked here
- Splash zone
- CodeWhale through 0.8.67 when the agent reads attacker-controlled content or a user approves an attacker-influenced recurring job
- CodeWhale · coding agents · prompt injection
- In the wild
- Disputed
- Maintainer advisories include PoCs. In-the-wild exploitation is unconfirmed.
What happened
In the default interactive Agent profile, attacker-controlled text in a repository, issue or fetched page can steer CodeWhale into calling its shell tool. CodeWhale treated certain search commands as read-only based on their names. The reporter demonstrated that flags accepted by those commands could launch programs with the agent process’s privileges and skip the approval prompt.
The second flaw requires an automation creation approval. When the creation call omits auto_approve, an affected build treats later runs as auto-approved. This can allow changes through tools that write files or modify repositories. Recurring shell execution also requires allow_shell to be enabled. Both advisories include proof-of-concept steps and identify 0.9.0 as the first patched version.
What’s in the bowl
CVE-2026-83817CVSS 7.5Recurring job auto-approval
Omitting auto_approve when creating an automation can authorize later mutating tool calls without prompts.
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| CodeWhale | 0.9.0 |
Crime-scene timeline
Jul 16, 2026
CodeWhale releases 0.9.0
The release tag contains the fix commit the maintainers later identify in both advisories.
Nov 12, 2026
Maintainers publish two approval bypass advisories
Both advisories list releases through 0.8.67 as affected and 0.9.0 as fixed.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- CodeWhale interactive shell advisoryPrimaryGives the affected packages, fixed version and indirect prompt injection reproduction.
- CodeWhale automation advisoryPrimaryDocuments omitted auto_approve and the additional condition for recurring shell execution.
- CodeWhale 0.9.0 releasePrimaryRecords the patched release date.