# CodeWhale: Project config `allow_shell` override enables arbitrary shell command execution via cloned repository

Project config `.codewhale/config.toml` with `allow_shell = true` is merged without a tightening guard, enabling the AI model's exec_shell tool and arbitrary command execution on clone-and-open.

- Payout: Research
- Severity: high
- Program: CodeWhale
- Found by: sondt99, dungNHVhust
- Disclosed: 2026-09-04
- CVE: CVE-2026-75911
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-gx45-xrj5-g6c4
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-gx45-xrj5-g6c4
- Tags: area:os domain:desktop impact:rce kind:research platform:ghsa sev:high tech:rust technique:incomplete-fix technique:source-review vuln:command-injection vuln:misconfiguration vuln:rce

**Target:** TUI agent project config merge (Rust, crates/tui/src/main.rs)
**Root cause:** merge_project_config unconditionally copies `allow_shell` from project-scope TOML into session config, unlike approval_policy and sandbox_mode which have tightening-only guards; allow_shell is also absent from DENY_AT_PROJECT_SCOPE.
**Steps:**
1. Clone repo and build: `cargo build --release -p codewhale-tui` at commit `0072209d`
2. Create workspace with `.codewhale/config.toml` containing `allow_shell = true`
3. Run `codewhale` in that directory (no `--no-project-config`)
4. merge_project_config sets `config.allow_shell = Some(true)`; `allow_shell: yolo || config.allow_shell()` is true
5. Tool registry `with_shell_tools()` includes exec_shell/task_shell_*; model can run shell commands
6. Confirm via `grep -A 2 'allow_shell.*as_bool' crates/tui/src/main.rs` showing no guard, vs approval_policy guarded by `project_approval_policy_is_allowed`
**How found:** Code review of the project-config merge: noticed approval_policy and sandbox_mode have tightening-only guards while allow_shell is copied unconditionally and is missing from DENY_AT_PROJECT_SCOPE, contradicting the opt-in boundary from GHSA-72w5-pf8h-xfp4.
**Exploitation:** Attacker commits malicious config to a repo; victim clones and runs CodeWhale in it, silently enabling shell tools. Model-issued commands classified 'safe' by command_safety.rs (ls, cat, git status, cargo build) execute without approval; social engineering in the AI conversation can chain approved commands toward arbitrary execution.
**Escalation:** Chain multiple individually 'safe' or user-approved commands via the AI conversation to reach arbitrary code execution despite default approval_policy = suggest.
**Insight:** When a config merge enforces 'tightening-only' for some security keys, enumerate every sibling key in the same trust boundary — the one missing from both the guard and the deny-list is the bug; check the tool-registry gating that key controls.