Skip to content
Heist/ feed
Back to feed
Critical

CodeWhale: run_tests Tool Enables RCE via Malicious Repository Without Approval

Type: advisorySources: OSV

CodeWhale is a DeepSeek + MiMo coding agent in terminal. From 0.3.0 to 0.8.23, the run_tests tool executes cargo test in the workspace with ApprovalRequirement::Auto, meaning it runs without any user approval prompt. cargo test compiles and executes arbitrary code: test binaries, build.rs build scripts, and proc macros. While auto-approving test execution is a deliberate design choice, it creates an inconsistency in the security boundary. However, in a malicious repository, test code can execute arbitrary shell commands, exfiltrate credentials, or establish persistence with zero approval. The attack is amplified by AGENTS.md (auto-loaded into the system prompt), which can instruct the model to run tests proactively at session start. This vulnerability is fixed in 0.8.23.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-45311
Confirmed fixed CVEs
Not specified
Updated in this feed
7 Nov 2026, 20:28 UTC · Revision 1

Source evidence

CodeWhale: run_tests Tool Enables RCE via Malicious Repository Without Approval

core-osv · Original source

Published 28 May 2026, 17:32 UTC

CodeWhale is a DeepSeek + MiMo coding agent in terminal. From 0.3.0 to 0.8.23, the run_tests tool executes cargo test in the workspace with ApprovalRequirement::Auto, meaning it runs without any user approval prompt. cargo test compiles and executes arbitrary code: test binaries, build.rs build scripts, and proc macros. While auto-approving test execution is a deliberate design choice, it creates an inconsistency in the security boundary. However, in a malicious repository, test code can execute arbitrary shell commands, exfiltrate credentials, or establish persistence with zero approval. The attack is amplified by AGENTS.md (auto-loaded into the system prompt), which can instruct the model to run tests proactively at session start. This vulnerability is fixed in 0.8.23.

osv:CVE-2026-45311
Complete source record
{
  "id": "ea3424f06b881b38f7839702e7e6d04ca16226b2c5c66bbe643bec44a5edf0e6",
  "url": "https://osv.dev/vulnerability/CVE-2026-45311",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CodeWhale: run_tests Tool Enables RCE via Malicious Repository Without Approval",
    "summary": "CodeWhale is a DeepSeek + MiMo coding agent in terminal. From 0.3.0 to 0.8.23, the run_tests tool executes cargo test in the workspace with ApprovalRequirement::Auto, meaning it runs without any user approval prompt. cargo test compiles and executes arbitrary code: test binaries, build.rs build scripts, and proc macros. While auto-approving test execution is a deliberate design choice, it creates an inconsistency in the security boundary. However, in a malicious repository, test code can execute arbitrary shell commands, exfiltrate credentials, or establish persistence with zero approval. The attack is amplified by AGENTS.md (auto-loaded into the system prompt), which can instruct the model to run tests proactively at session start. This vulnerability is fixed in 0.8.23.",
    "evidence": "osv:CVE-2026-45311",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2026-45311",
      "aliases": [
        "CVE-2026-45311",
        "GHSA-wx44-2q6h-j6p8"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/codewhale-hq/Codewhale",
              "type": "GIT",
              "events": [
                {
                  "introduced": "3204f556af2cf5f0bcc604fb9fd230b3a5a2e965"
                },
                {
                  "fixed": "cfb5f08ae515f8dcf93aa10bdcf37dff3549e7ec"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0.3.0"
                      },
                      {
                        "fixed": "0.8.23"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.8.23"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v0.8.22",
            "v0.8.21",
            "v0.8.20",
            "v0.8.19",
            "v0.8.18",
            "v0.8.17",
            "v0.8.15",
            "v0.8.14",
            "v0.8.13",
            "v0.8.12",
            "v0.8.11",
            "v0.8.10",
            "v0.8.9",
            "v0.8.8",
            "v0.8.7",
            "v0.8.6",
            "v0.8.5",
            "v0.8.4",
            "v0.8.3",
            "v0.8.2",
            "v0.8.1",
            "v0.8.0",
            "v0.7.9",
            "v0.7.8",
            "v0.7.7",
            "v0.7.6",
            "v0.7.5",
            "v0.7.4",
            "v0.7.2",
            "v0.7.1",
            "v0.7.0",
            "v0.6.7",
            "v0.6.6",
            "v0.6.5",
            "v0.6.4",
            "v0.6.3",
            "v0.6.2",
            "v0.6.1",
            "v0.5.2",
            "v0.5.1",
            "v0.5.0",
            "v0.4.9",
            "v0.4.8",
            "v0.4.7",
            "v0.4.6",
            "v0.4.5",
            "v0.4.4",
            "v0.4.3",
            "v0.4.2",
            "v0.4.1",
            "v0.4.0",
            "v0.3.33",
            "v0.3.32",
            "v0.3.31",
            "v0.3.28",
            "v0.3.27",
            "v0.3.26",
            "v0.3.25",
            "v0.3.24",
            "v0.3.23",
            "v0.3.22",
            "v0.3.21",
            "v0.3.20",
            "v0.3.19",
            "v0.3.18",
            "v0.3.17",
            "v0.3.16",
            "v0.3.14",
            "v0.3.13",
            "v0.3.12",
            "v0.3.11",
            "v0.3.10",
            "v0.3.5",
            "v0.3.4",
            "v0.3.3",
            "v0.3.2",
            "v0.3.1",
            "v0.3.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45311.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:51.476915677Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45311.json",
        "https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-wx44-2q6h-j6p8",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-45311"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-94"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45311.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-45311",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 520312,
  "published_at": "2026-05-28T17:32:26.95+00:00"
}