CodeWhale rlm_eval Auto-Approval Prompt Injection RCE

Technical Analysis

The vulnerability stems from rlm_eval's approval_requirement() hardcoding ApprovalRequirement::Auto, which the agent engine interprets as 'never require approval,' overriding the user-configured --approval-policy. Because the agent ingests untrusted external content (web pages, fetched URLs, repository files, or MCP tool results) as part of normal operation, an attacker can embed prompt injection payloads in that content instructing the LLM to invoke rlm_eval with malicious Python code. The companion rlm_open tool can be used to stage or fetch attacker-controlled content into the agent's context, effectively acting as a delivery mechanism. Once triggered, the code executes directly in a python3 subprocess without any human-in-the-loop check, giving the attacker code execution at full user privilege and crossing the boundary from 'untrusted data read by the agent' to 'arbitrary local code execution' with no isolation or audit step.

Affected Systems

CodeWhale, codewhale-tui; protocols: MCP

Detection Signatures

• Log entries showing rlm_eval invocation with no corresponding approval-prompt event
• approval_requirement()/ApprovalRequirement::Auto appearing in tool metadata for code-execution tools
• Unexpected python3 child processes spawned by the CodeWhale agent process
• rlm_open fetching external URLs/files immediately followed by rlm_eval calls
• Content from fetched pages/repos containing embedded imperative instructions (e.g. 'run this code', 'execute the following Python') intended for the agent rather than the human user
• codewhale/codewhale-tui package versions >=0.8.41 and <0.8.64

Remediation Steps

1. 1

   Upgrade CodeWhale

   Update codewhale / codewhale-tui to version 0.8.64 or later, which fixes the approval_requirement() logic for rlm_eval.

2. 2

   Enforce approval policy for code execution tools

   Audit all tool definitions for approval_requirement() implementations; ensure no tool that executes arbitrary code can silently declare Auto/never-prompt status, regardless of user config.

3. 3

   Sandbox code execution

   Run rlm_eval and similar interpreter tools in an isolated, least-privilege sandbox (containerized, no host filesystem/network access) rather than directly on the user's machine.

4. 4

   Treat fetched content as untrusted

   Apply content sanitization/isolation to data returned by rlm_open, web fetches, and MCP tool results before it is placed in the agent's context, and strip or flag imperative-style instructions embedded in fetched content.

5. 5

   Audit logging for auto-approved actions

   Add mandatory logging/alerting whenever a tool executes with Auto approval so unusual auto-approved code execution can be detected retroactively.