Hmbown CodeWhale versions from 0.3.0 to before 0.8.23 include a vulnerability (CWE-94) where the run_tests tool executes 'cargo test' with ApprovalRequirement::Auto, bypassing user approval. Since 'cargo test' compiles and runs arbitrary code including test binaries, build scripts, and procedural macros, this design choice creates a security boundary inconsistency. Malicious code in a repository can leverage this to execute arbitrary shell commands, steal credentials, or maintain persistence without user interaction. The AGENTS.md file can further automate this exploitation by instructing the model to run tests at session start. The vulnerability is resolved in version 0.8.23.

Successful exploitation allows an attacker to execute arbitrary code on the system running CodeWhale without user approval, potentially leading to credential theft, system persistence, and full compromise of confidentiality, integrity, and availability. The CVSS v3.1 score is 9.6 (critical), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported.

This vulnerability is fixed in CodeWhale version 0.8.23. Users should upgrade to version 0.8.23 or later to remediate the issue. Patch status is not explicitly confirmed in the vendor advisory, but the description states the vulnerability is fixed in 0.8.23. Until upgrading, users should avoid running CodeWhale on untrusted repositories or disable automatic test execution if possible.