CodeWhale Auto-Approval Bypass on Interactive Shell Tool Enables Prompt-Injected Command Execution

Technical Analysis

The vulnerability stems from exec_shell_interact's approval_requirement being hardcoded to ApprovalRequirement::Auto instead of inheriting the framework's default Required policy for code-executing tools. Because the tool writes LLM-generated stdin into a persistent interactive shell process (python3 -i, mysql, ssh, sudo -i) that was approved once at session start, every subsequent command sent to that session bypasses re-approval. An attacker who can influence the LLM's context, via a fetched webpage, an MCP server response, or a file in a cloned repository, can embed instructions that the agent interprets as legitimate commands, achieving prompt injection that crosses into privileged code execution without any human-in-the-loop check. This effectively converts a content-ingestion vulnerability into remote command execution at the privilege level of whatever session the shell tool is attached to (e.g., root via sudo, or a remote host via ssh).

Affected Systems

CodeWhale; protocols: MCP

Detection Signatures

• Tool definitions where approval_requirement or equivalent metadata is set to Auto for shell/exec/interactive tools despite a framework default of Required
• Log entries showing exec_shell_interact or exec_interact invoked without a preceding approval/consent event
• Unexpected commands appearing in stdin of long-running interactive sessions (python3 -i, mysql, ssh, sudo -i) immediately following ingestion of external content (fetched URLs, MCP tool outputs, repo files)
• Sequences where an agent fetches untrusted content and shortly after issues shell commands matching instructions embedded in that content
• CodeWhale version strings between 0.8.41 and 0.8.63 in deployment manifests

Remediation Steps

1. 1

   Upgrade CodeWhale

   Update to version 0.8.64 or later, which restores Required approval enforcement for exec_shell_interact/exec_interact.

2. 2

   Audit tool approval metadata

   Review all custom and third-party tool definitions for approval_requirement or equivalent fields to ensure code-executing tools cannot silently declare themselves auto-approved.

3. 3

   Isolate interactive sessions

   Run interactive shells, database clients, and SSH sessions invoked by agents inside sandboxed, least-privilege environments so that even if commands are injected, blast radius is limited.

4. 4

   Treat ingested content as untrusted

   Apply strict input sanitization and instruction-filtering to content from web fetches, MCP tool results, and repository files before it reaches the agent's planning/execution context.

5. 5

   Require re-approval per command

   Configure or patch the agent to require human confirmation for each command sent into a long-running privileged session, not just the initial session start.

6. 6

   Monitor for anomalous shell activity

   Deploy logging/alerting on interactive shell sessions to detect command patterns inconsistent with the operator's original intent.