{"id":"EUVD-2026-32964","enisaUuid":"8bfe17f3-1d76-3b87-a77c-f68e491fd939","description":"CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.22, the fetch_url tool validates the initial URL\u0027s resolved IP address against a restricted-IP blocklist (is_restricted_ip()) to prevent SSRF attacks against internal services (cloud metadata endpoints, localhost, private networks). However, the HTTP client (reqwest) is configured to automatically follow up to 5 redirects (reqwest::redirect::Policy::limited(5)) without re-validating the redirect target against the same SSRF protections. This vulnerability is fixed in 0.8.22.","datePublished":"May 28, 2026, 5:30:09 PM","dateUpdated":"May 30, 2026, 2:09:17 AM","baseScore":7.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","references":"https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-96ff-gc8g-wpvg\nhttps://github.com/Hmbown/DeepSeek-TUI/releases/tag/v0.8.22\n","aliases":"CVE-2026-45310\nGHSA-96ff-gc8g-wpvg\n","assigner":"GitHub_M","epss":0.28,"enisaIdProduct":[{"id":"0576ce99-f429-3bb0-b513-5e18cc30d501","product":{"name":"CodeWhale","vendor":{"name":"Hmbown"}},"product_version":"\u003c 0.8.22"}],"enisaIdVendor":[{"id":"f17382c5-e495-30ff-b7bf-87a2ac021a86","vendor":{"name":"Hmbown"}}],"enisaIdVulnerability":[{"id":"e190fd7e-2b1e-31e9-8ffc-d5480ef29471","vulnerability":{"id":"GHSA-96ff-gc8g-wpvg","description":"DeepSeek TUI has SSRF via HTTP Redirect Bypass in fetch_url Tool","datePublished":"May 14, 2026, 8:29:26 PM","dateUpdated":"Jun 9, 2026, 10:19:44 AM","baseScore":0.0,"references":"https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-96ff-gc8g-wpvg\nhttps://github.com/Hmbown/DeepSeek-TUI/security/advisories/GHSA-96ff-gc8g-wpvg\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-45310\nhttps://github.com/Hmbown/DeepSeek-TUI\nhttps://github.com/Hmbown/DeepSeek-TUI/releases/tag/v0.8.22\n","enisa_id":"EUVD-2026-32964\n","aliases":"GHSA-96ff-gc8g-wpvg\nCVE-2026-45310\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e7db6b11-a97b-3347-9a6d-bd336e753eef","vulnerability":{"id":"CVE-2026-45310","description":"CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.22, the fetch_url tool validates the initial URL\u0027s resolved IP address against a restricted-IP blocklist (is_restricted_ip()) to prevent SSRF attacks against internal services (cloud metadata endpoints, localhost, private networks). However, the HTTP client (reqwest) is configured to automatically follow up to 5 redirects (reqwest::redirect::Policy::limited(5)) without re-validating the redirect target against the same SSRF protections. This vulnerability is fixed in 0.8.22.","datePublished":"May 28, 2026, 5:30:09 PM","dateUpdated":"May 30, 2026, 2:09:17 AM","status":"PUBLISHED","baseScore":7.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","references":"https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-96ff-gc8g-wpvg\nhttps://github.com/Hmbown/DeepSeek-TUI/releases/tag/v0.8.22\n","enisa_id":"EUVD-2026-32964\n","assigner":"GitHub_M","epss":0.28,"dataProcessed":"Nov 3, 2026, 7:17:32 AM","vulnerabilityProduct":[{"id":"6ea84453-338c-340f-ab67-a3e98e81ab07","product":{"name":"CodeWhale","vendor":{"name":"Hmbown"}},"product_version":"\u003c 0.8.22"}],"vulnerabilityVendor":[{"id":"51606390-5458-3ccf-81ae-32b2369bae8d","vendor":{"name":"Hmbown"}}]}}],"enisaIdAdvisory":[]}