CVE-2026-75857 Hmbown CVE debrief

Who should care

Defenders responsible for CodeWhale deployments using versions between 0.8.41 and 0.8.64 should assess potential exposure and impact, and prioritize verification and remediation efforts.

Why it matters

CVE-2026-75857 is a high-severity vulnerability in CodeWhale that could allow an attacker to inject instructions and cause commands to run at elevated privileges. Defenders should prioritize verifying exposure, assessing potential impact, and remediating affected systems.

• Potential command execution at elevated privileges
• Possible lateral movement within compromised systems
• Need for verification of affected versions and exposure
• Prioritization of remediation and compensating controls

Technical summary

The exec_shell_interact tool in CodeWhale versions >= 0.8.41 and < 0.8.64 has an approval requirement set to Auto, allowing LLM-controlled stdin to be written into an approved long-running interactive shell without a prompt. This could allow an attacker to inject instructions and cause commands to run at the privilege level of the approved process. Defenders should prioritize verifying exposure and assessing potential impact, focusing on CodeWhale deployments using versions between 0.8.41 and 0.8.64. The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on CodeWhale deployments using versions between 0.8.41 and 0.8.64.

Recommended defensive actions

• Verify CodeWhale version and assess exposure
• Review and restrict access to untrusted content
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, additional information on potential exploitation and impact is limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.