Two CodeWhale CVEs record tools that declared themselves auto-approved and overrode the user's approval policy

VulnCheck published two records on 2026-08-18 against CodeWhale, a coding agent distributed as the codewhale and codewhale-tui packages. Both describe the same root cause in different tools, and both were fixed by a single commit two months earlier.

The mechanism is a tool declaring its own approval requirement. CodeWhale's engine reads an approval_requirement() value from each tool, and ApprovalRequirement::Auto is treated as "never prompt". Two tools that execute code returned it. CVE-2026-75858 covers rlm_eval, where the record states arbitrary model-supplied Python ran in a python3 interpreter without consulting the user's configured --approval-policy and with no approval prompt or audit step. CVE-2026-75857 covers exec_shell_interact, where LLM-controlled stdin was written into an already-approved long-running interactive shell, the record naming a python3 -i REPL, mysql, ssh and sudo -i sessions as examples. In that second case the privilege level is whatever the approved session already held, which is what makes it an escalation rather than plain execution.

Both records name the same delivery path: prompt injection through untrusted content the agent reads. CVE-2026-75857 lists the candidates explicitly as a fetched page, an MCP result, or a repository file, which puts a tool result from a connected MCP server on the same footing as a web page for this purpose.

The interesting part for the wider ecosystem is which safeguard failed. The user had a configured approval policy and code-executing tools had a Required default; a per-tool metadata value silently outranked both. Any host that lets a tool describe its own risk level, whether through an internal enum or through the specification's tool annotations, is trusting that declaration with the human-in-the-loop guarantee. The fix, commit 57f3c894 on 2026-06-21, is titled "require approval for interactive execution tools" and closed both records at once, eight weeks before either was published. The codewhale package recorded 19,593 downloads in the last month.