Cyber Resilience

CVE-2026-45374

CriticalRCEUpdated

Published: 28 May 2026

Published
28 May 2026
Modified
17 June 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS Score 0.0026 17.4th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-45374 is a critical-severity Code Injection (CWE-94) vulnerability. Its CVSS base score is 9.6 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked at the 17.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the LLM/Generative AI Risks risk domain.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability details

CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, the task_create tool spawns durable sub-agents that inherit two insecure defaults, allow_shell defaults to true (config.rs:1499: self.allow_shell.unwrap_or(true)) and auto_approve defaults to true (task_manager.rs:297: auto_approve: Some(true)). When a…

more

user approves a task_create call (which requires ApprovalRequirement::Required), they approve what appears to be a benign work prompt. However, the spawned sub-agent silently receives unrestricted, unapproved shell access. This vulnerability is fixed in 0.8.26.

CWE(s)
CWE-94

AI Security AnalysisAI

AI Category
AI Agent Protocols and Integrations
Risk Domain
LLM/Generative AI Risks
OWASP Top 10 for LLMs 2025
None mapped
Classification Reason
Matched keywords: deepseek

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

Insecure defaults (allow_shell=true, auto_approve=true) on spawned sub-agents directly enable unauthorized Unix shell command execution after initial user approval.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-57283Shared CWE-94
CVE-2025-69902Shared CWE-94
CVE-2026-44244Shared CWE-94
CVE-2026-2287Shared CWE-94
CVE-2025-5120Shared CWE-94
CVE-2026-26830Shared CWE-94
CVE-2024-54804Shared CWE-94
CVE-2025-67038Shared CWE-94
CVE-2024-54806Shared CWE-94
CVE-2024-36057Shared CWE-94

Affected Assets

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-34 Non-modifiable Executable Programs
addresses: CWE-94

Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.

SC-44 Detonation Chambers
addresses: CWE-94

Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.

SI-10 Information Input Validation
addresses: CWE-94

Validates inputs used in dynamic code generation to block injected directives.

SI-16 Memory Protection
addresses: CWE-94

Directly prevents execution of attacker-supplied code written into data memory regions.

References