CVE-2026-45374: CodeWhale: task_create Insecure Defaults Enable RCE via Prompt Injection in Project Files

Synopsis

A prompt-injection-driven remote code execution vulnerability exists in CodeWhale, a DeepSeek and MiMo-powered coding agent that runs in the terminal. An attacker can embed malicious instructions inside project files (such as source code, README files, or configuration files) that the agent reads; when a user approves what looks like a routine task_create call, the spawned sub-agent silently inherits allow_shell=true and auto_approve=true, giving it unrestricted, unapproved shell access on the host. Successful exploitation gives the attacker full command execution on the user's machine without any further confirmation step. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the malicious prompt payload (embedded in project files) to a victim who fetches or opens them over the network, so the attack reaches the agent via network-accessible content.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated party who can place or influence a file the user opens can trigger the vulnerability.

• Victim interactionRequired

  The user must approve a task_create call that appears benign, making this a social-engineering vector where the victim is the unwitting approver.

• Attack complexityDetail

  Attack complexity is low; the exploit requires no race conditions or special environmental conditions and is reliably reproducible once a malicious prompt is in a file the agent processes.

Blast Radius

• The spawned sub-agent executes arbitrary shell commands on the host without further user confirmation, giving the attacker full control of the local environment.
• Confidential files, secrets, API keys, and credentials stored on the filesystem are readable and exfiltrable.
• The attacker can modify, overwrite, or delete any file accessible to the user running CodeWhale, including source code and build artifacts.
• The process can crash or permanently disrupt the local development environment and any services it manages.