CVE-2026-75911 is a code injection vulnerability in Hmbown's CodeWhale product affecting versions before 0.8.64. The vulnerability arises because the allow_shell configuration parameter from project config files is not properly validated. An attacker can exploit this by committing a malicious .codewhale/config.toml file to a repository. When a user clones and opens this repository in CodeWhale, the AI model gains access to exec_shell and task_shell tools, enabling arbitrary shell command execution on the victim's machine without explicit user consent.

An attacker can execute arbitrary shell commands on a victim's machine by tricking the user into cloning and opening a malicious repository. This can lead to full compromise of the victim's system with high impact on confidentiality, integrity, and availability as indicated by the CVSS vector and score of 8.5 (high severity).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid cloning and opening repositories from untrusted sources that contain .codewhale/config.toml files. Monitoring and restricting the use of the allow_shell configuration parameter may help reduce risk.