Skip to content
Fencer Vulns
critical 9.6

CVE-2026-45311 json

CodeWhale: run_tests Tool Enables RCE via Malicious Repository Without Approval

published 2026-05-14 5 mo ago modified 2026-10-26 14 d ago also GHSA-wx44-2q6h-j6p8 , EUVD-2026-32965

cvss
9.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits
0
none known

Summary

CodeWhale is a DeepSeek + MiMo coding agent in terminal. From 0.3.0 to 0.8.23, the run_tests tool executes cargo test in the workspace with ApprovalRequirement::Auto, meaning it runs without any user approval prompt. cargo test compiles and executes arbitrary code: test binaries, build.rs build scripts, and proc macros. While auto-approving test execution is a deliberate design choice, it creates an inconsistency in the security boundary. However, in a malicious repository, test code can execute arbitrary shell commands, exfiltrate credentials, or establish persistence with zero approval. The attack is amplified by AGENTS.md (auto-loaded into the system prompt), which can instruct the model to run tests proactively at session start. This vulnerability is fixed in 0.8.23.

Patch / fix

  • crates.io deepseek-tui 0.8.23
  • crates.io deepseek-tui-cli 0.8.23
  • npm deepseek-tui 0.8.23

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
5 mo ago

Exploit prediction

0.57% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-wx44-2q6h-j6p8 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
GitHub 3.1 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
crates.io deepseek-tui
>=0.3.0, <0.8.23
0.8.23
crates.io deepseek-tui-cli
>=0.3.0, <0.8.23
0.8.23
npm deepseek-tui
>=0.3.0, <0.8.23
0.8.23

Affected products

  • Hmbown CodeWhale

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.