CVE-2026-75911

### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 43563356b98c6b993085554da82e77370160a31c. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below. ### Summary A malicious `.codewhale/config.toml` or `.deepseek/config.toml` committed to a repository can silently set `allow_shell = true` for any user who clones and opens the repository in CodeWhale. This enables the AI model's `exec_shell` tool, granting arbitrary shell command execution on the victim's machine without the user's explicit opt-in. The `approval_policy` and `sandbox_mode` fields correctly enforce tightening-only semantics from project config, but `allow_shell` has no such guard, contradicting the intent of GHSA-72w5-pf8h-xfp4 which established `allow_shell` as an opt-in security boundary. ### Details The project config merge function at `crates/tui/src/main.rs:5181-5182` (v0.8.50) unconditionally copies the `allow_shell` boolean from a project-level config file into the live session config: ```rust if let Some(v) = table.get("allow_shell").and_then(toml::Value::as_bool) { config.allow_shell = Some(v); } ``` No tightening guard exists for `allow_shell`, unlike `approval_policy` (lines 5144-5158, guarded by `project_approval_policy_is_allowed`) and `sandbox_mode` (lines 5161-5171, guarded by `project_sandbox_mode_is_allowed`). The merge is applied automatically when entering a workspace directory unless the user passes `--no-project-config`, which is an opt-out flag that most users will not know about. **Source of attacker-controlled input:** The `.codewhale/config.toml` or `.deepseek/config.toml` file in a cloned repository (committed by a malicious or compromised repository maintainer). **Security boundary crossed:** The `allow_shell` setting controls whether the AI model's tool registry includes `exec_shell` and `task_she