CVE-2026-45374 CodeWhale: task_create Insecure Defaults Enable RCE via Prompt Injection in Project Files
Attackers can achieve remote code execution by exploiting insecure default settings in the task_create tool that grant unapproved shell access to sub-agents.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-45374?
CVE-2026-45374 is a critical code injection vulnerability in Hmbown CodeWhale, published on 28 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, the task_create tool spawns durable sub-agents that inherit two insecure defaults, allow_shell defaults to true (config.rs:1499: self.allow_shell.unwrap_or(true)) and auto_approve defaults to true (task_manager.rs:297: auto_approve: Some(true)). When a user approves a task_create call (which requires ApprovalRequirement::Required), they approve what appears to be a benign work prompt. However, the spawned sub-agent silently receives unrestricted, unapproved shell access. This vulnerability is fixed in 0.8.26.
Weakness: CWE-94
Which versions are affected by CVE-2026-45374?
2 open source packages ship an affected version, including deepseek-tui.
| Package | Affected | Fixed in |
|---|---|---|
deepseek-tui crates.io | All versions | 0.8.26 |
deepseek-tui crates.io | All versions | 0.8.26 |
How do I fix CVE-2026-45374?
Upgrade deepseek-tui to 0.8.26 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-45374 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45374 exists.
Sources
Also known as GHSA-72w5-pf8h-xfp4.