EventPast event
CodeWhale rlm_eval 工具绕过审批策略致 RCE
Start here
AI overview
CodeWhale 的 rlm_eval 工具存在任意 Python 代码执行漏洞：其 approval_requirement() 返回 ApprovalRequirement::Auto，引擎将其视为永不询问，从而绕过用户配置的 --approval-policy（如 on-request、unless-trusted），导致任意代码执行。维护者已确认并修复该漏洞，0.8.64 版本在 commit 57f3c89 中完成修补，用户应升级到 0.8.64 或更高版本。该漏洞对应 GHSA-wrj3-vj8c-784f（credit sai-sh）与 CVE-2026-75858。
Generated by AI from reports · Updated 8 days ago
Progress timeline
Date not provided
- Date not givenHmbown/CodeWhale GHSA-wrj3-vj8c-784f（credit sai-sh）；CVE-2026-75858SelectedCodeWhale fixes arbitrary code execution vulnerability in rlm_eval that bypasses approval policy
CodeWhale 维护者确认并修复了 rlm_eval 工具的任意 Python 代码执行漏洞，0.8.64 版本在 commit 57f3c89 中完成修补，用户应升级到 0.8.64 或更高版本。该工具的 approval_requirement() 返回 ApprovalRequirement::Auto，引擎将其视为永不询问，从而绕过用户配置的 --approval-policy（on-request、unless-trusted、never），且不产生审批事件。报告指出这与此前已在 run_tests 工具上修补的 CVE-2026-45311 属同一缺陷，修复未覆盖 rlm_eval 和 rlm_open，后两者暴露面更大。
Related discussion
Attention trend
New sources per day
- Oct 5New1 sources (1 outlets,0 accounts)
- Oct 6New0 sources (0 outlets,0 accounts)
- Oct 7New0 sources (0 outlets,0 accounts)
- Oct 8New0 sources (0 outlets,0 accounts)
- Oct 9New0 sources (0 outlets,0 accounts)
- Oct 10New0 sources (0 outlets,0 accounts)
- Oct 11New0 sources (0 outlets,0 accounts)
- Oct 12New0 sources (0 outlets,0 accounts)
- Oct 13New0 sources (0 outlets,0 accounts)