CVE-2026-75858

### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 57f3c89471e27ac4032d9791f6885e5d4408c381. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below. ### Summary The `rlm_eval` tool runs an arbitrary Python string chosen by the model in a real `python3` interpreter. Its `approval_requirement()` returns `ApprovalRequirement::Auto`, which the engine treats as "never prompt," regardless of the user's configured `--approval-policy`. A single tool call — which prompt injection from any untrusted content the agent reads (a web page, a fetched URL, a repo file, an MCP tool result) can induce — runs code on the user's machine at the user's privilege with no prompt and no audit step. This is the same defect that was already patched on the sibling `run_tests` tool (CVE-2026-45311); the fix never reached `rlm_eval` or `rlm_open`, which expose a broader surface (full Python on the host, not just `cargo test`). ### Details `rlm_eval`'s `execute()` reads the LLM-controlled `code` field and runs it (`crates/tui/src/tools/rlm.rs:215-300`): ```rust fn capabilities(&self) -> Vec<ToolCapability> { vec![ToolCapability::Network, ToolCapability::ExecutesCode] } fn approval_requirement(&self) -> ApprovalRequirement { ApprovalRequirement::Auto // overrides the safe default below } async fn execute(&self, input: Value, context: &ToolContext) -> Result<ToolResult, ToolError> { let name = required_non_empty_str(&input, "name")?; let code = required_non_empty_str(&input, "code")?; // LLM-controlled ... let round = kernel.run(code, Some(&bridge)).await... // runs that code in python3 ``` The trait default at `crates/tui/src/tools/spec.rs:632-633` would have returned `Required` for any tool whose capabilities include `ExecutesCode`. `rlm_eval` deliberately overrides that to `Auto`. The