CVE-2026-45311: CodeWhale: run_tests Tool Enables RCE via Malicious Repository Without Approval

Synopsis

Remote code execution vulnerability in CodeWhale, a terminal-based AI coding agent, affects versions 0.3.0 through 0.8.23. The run_tests tool executes cargo test with automatic approval (no user prompt), meaning that a malicious repository can embed arbitrary code in test binaries, build scripts, or proc macros that runs immediately when the agent processes the repo. A victim must open the malicious repository with CodeWhale, but once they do, an attacker achieves full code execution on the host with no further barriers. No fix version has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the malicious repository over the network; the victim must fetch or open a remote repo, exposing the attack surface to any network-accessible source.

• AuthenticationNot required

  No credentials or account privileges are needed; any unauthenticated party can publish or share a malicious repository.

• Victim interactionRequired

  The victim must open the malicious repository with CodeWhale, making social engineering (e.g., sharing a repo link) the required delivery mechanism.

• Attack complexityDetail

  Exploitation is reliable and condition-free once the repository is opened; no race conditions, memory layout dependencies, or special environmental factors apply.

Blast Radius

• Arbitrary shell commands execute on the victim's host inside the terminal session with the victim's user privileges.
• Test code or build scripts read and exfiltrate credentials, SSH keys, API tokens, or environment variables stored on the machine.
• An attacker establishes persistence by writing files, installing cron jobs, or modifying shell profiles on the host.
• The AGENTS.md mechanism allows the malicious repo to instruct the AI model to trigger test execution automatically at session start, removing even the implicit friction of a manual command.