CodeWhale rlm_eval before 0.8.64 Remote Code Execution
Published Aug 18, 2026
8.5
HIGHCVSS 4.0
EPSS 0.36%
Description
CodeWhale (packages codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain a remote code execution vulnerability in the rlm_eval tool. The tool's approval_requirement() returns ApprovalRequirement::Auto, which the engine treats as 'never prompt,' causing arbitrary model-supplied Python code to run in a python3 interpreter without consulting the user's configured --approval-policy and without any approval prompt or audit step. An attacker can induce the agent to execute arbitrary code via prompt injection in untrusted content the agent reads (a web page, fetched URL, repository file, or MCP tool result); the companion rlm_open tool can stage such content. Code runs on the user's machine at the user's privilege level. Fixed in 0.8.64.
Affected products
-
- Version 0.8.33StatusaffectedConstraints<0.8.41
- Version 0.8.41StatusaffectedConstraints<0.8.64
- Version 0.8.41StatusunaffectedConstraints-
- Version 0.8.64StatusunaffectedConstraints-
- Version
No data.
No data.
No Red Hat product state for this CVE.
deepseek-tui
crates.io
Introduced 0.8.33 Fixed not fixeddeepseek-tui
npm
Introduced 0.8.33 Fixed 0.8.41codewhale-tui
crates.io
Introduced 0.8.41 Fixed 0.8.64codewhale
npm
Introduced 0.8.41 Fixed 0.8.64
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | deepseek-tui | 0.8.33 | not fixed |
| npm | deepseek-tui | 0.8.33 | 0.8.41 |
| crates.io | codewhale-tui | 0.8.41 | 0.8.64 |
| npm | codewhale | 0.8.41 | 0.8.64 |
Remediation
No remediation recorded yet.
Metrics
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
1 other source (NVD) ▾
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
PoCAutomatable
NoTechnical Impact
TotalDecision
n/aAssessed Aug 18, 2026 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
Aug–Oct 2026- EPSS v5
Percentile over time
- EPSS v5
Table of values (2 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 0.36% (0.00364) | 27.90th | v5 (v2026.06.15) |
| Aug 19, 2026 | 0.27% (0.00267) | 18.98th | v5 (v2026.06.15) |
References (5)
- https://github.com/Hmbown/CodeWhale/commit/57f3c89471e27ac4032d9791f6885e5d4408c381 patch
- https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-wrj3-vj8c-784f exploitvendor-advisory
- https://github.com/advisories/GHSA-wrj3-vj8c-784f Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-75858
- https://www.vulncheck.com/advisories/codewhale-rlm-eval-before-remote-code-execution third-party-advisory
Change history (0)
No recorded changes yet.